cyber-sdd 0.7.0 → 0.7.2

package/skills/resolve-governances/scripts/resolve-governances.mjs

@@ -1,12 +1,352 @@
-// Launcher for the engine of the same name. Run it as `node <skill>/scripts/<engine>.mjs`.
-// A checkout runs the .mts source. An npm install keeps the skill under node_modules, where Node
-// will not strip types, so it runs the self-contained bundle built for the package.
-import { spawnSync } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
-
-const self = fileURLToPath(import.meta.url)
-const installed = /[\\/]node_modules[\\/]/.test(self)
-const target = self.replace(/\.mjs$/, installed ? '.bundle.mjs' : '.mts')
-const run = spawnSync(process.execPath, [...process.execArgv, target, ...process.argv.slice(2)], { stdio: 'inherit' })
-if (run.error) throw run.error
-process.exitCode = run.status ?? 1
+#!/usr/bin/env node
+// Compiled by `universal-plugin plugin build` from src/resolve-governances/resolve-governances.mts. Edit the source, not this file.
+globalThis.__SKILL_SCRIPT__ = {"package":null,"bin":null,"version":"0.7.2","entry":"skills/resolve-governances/scripts/resolve-governances.mjs","commands":{}};
+import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+//#region src/resolve-governances/resolve-governances.mts
+const ROLE_KEYS = [
+	"spec-producer",
+	"solution-producer",
+	"spec-judge",
+	"impl-producer",
+	"impl-judge"
+];
+const BAR_KEYS = [
+	"oracle-spec",
+	"builder-spec",
+	"builder-impl",
+	"architect-spec",
+	"architect-impl"
+];
+const ACTORS = [
+	"oracle",
+	"builder",
+	"architect"
+];
+const GATES = ["spec", "impl"];
+const ROLE_LOADOUT = {
+	"spec-producer": { bars: ["oracle-spec", "builder-spec"] },
+	"solution-producer": { bars: ["architect-spec"] },
+	"spec-judge": { bars: [
+		"oracle-spec",
+		"builder-spec",
+		"architect-spec"
+	] },
+	"impl-producer": { bars: ["builder-impl", "architect-impl"] },
+	"impl-judge": { bars: ["builder-impl", "architect-impl"] }
+};
+const SDD_DEFAULT_AGENT = {
+	"spec-producer": null,
+	"solution-producer": null,
+	"spec-judge": "sdd-spec-judge",
+	"impl-producer": null,
+	"impl-judge": "sdd-impl-judge"
+};
+function migrateRoles(rolesIn) {
+	const roles = { ...rolesIn ?? {} };
+	if ("plan-producer" in roles) {
+		const legacy = roles["plan-producer"];
+		if (!("solution-producer" in roles)) roles["solution-producer"] = legacy;
+		delete roles["plan-producer"];
+	}
+	return roles;
+}
+function migrateGovernances(gIn) {
+	const g = gIn ?? {};
+	return "oracle" in g || "builder" in g || "architect" in g ? {
+		"oracle-spec": g.oracle ?? null,
+		"builder-spec": g.builder ?? null,
+		"builder-impl": g.builder ?? null,
+		"architect-spec": g.architect ?? null,
+		"architect-impl": g.architect ?? null
+	} : { ...g };
+}
+function migrateSquad(sq) {
+	const types = sq["artifact-types"] ?? sq.domains ?? [];
+	return {
+		"artifact-types": Array.isArray(types) ? types : [],
+		roles: migrateRoles(sq.roles),
+		governances: migrateGovernances(sq.governances)
+	};
+}
+function migrateEntry(entry) {
+	const squads = Array.isArray(entry.squads) ? entry.squads.map(migrateSquad) : [migrateSquad({
+		"artifact-types": entry.domains,
+		roles: entry.roles,
+		governances: entry.governances
+	})];
+	return {
+		name: entry.name,
+		version: entry.version,
+		squads
+	};
+}
+function parseRegistry(text) {
+	let raw;
+	try {
+		raw = JSON.parse(text);
+	} catch (e) {
+		throw new Error(`registry is not valid JSON: ${e.message}`);
+	}
+	if (!raw || typeof raw !== "object" || !Array.isArray(raw["sdd-plugins"])) throw new Error("registry has no sdd-plugins array");
+	return { "sdd-plugins": raw["sdd-plugins"].map(migrateEntry) };
+}
+function loadRegistry(root) {
+	const path = join(root, ".agents", "universal-plugin.json");
+	if (!existsSync(path)) return { "sdd-plugins": [] };
+	return parseRegistry(readFileSync(path, "utf8"));
+}
+function parseArtifactTypeMap(text) {
+	const out = [];
+	for (const raw of text.split("\n")) {
+		const line = raw.trim();
+		if (!line || line.startsWith("#") || line.startsWith("[")) continue;
+		const m = /^(?:"([^"]+)"|'([^']+)'|(\S+))\s*=\s*(?:"([^"]+)"|'([^']+)')\s*(?:#.*)?$/.exec(line);
+		if (!m) continue;
+		const glob = m[1] ?? m[2] ?? m[3];
+		const type = m[4] ?? m[5];
+		if (glob && type) out.push({
+			glob,
+			type
+		});
+	}
+	return out;
+}
+function globToRegExp(glob) {
+	const re = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*+/g, (m) => m.length > 1 ? ".*" : "[^/]*").replace(/\?/g, ".");
+	return new RegExp(`^${re}$`);
+}
+function resolveArtifactTypeFromMap(map, path) {
+	const matches = map.filter((b) => globToRegExp(b.glob).test(path));
+	if (matches.length === 0) return null;
+	const literal = (g) => g.replace(/[*?]/g, "").length;
+	matches.sort((a, b) => literal(b.glob) - literal(a.glob) || b.glob.length - a.glob.length);
+	return matches[0].type;
+}
+function loadArtifactTypeMap(root) {
+	const path = join(root, ".agents", "sdd", "artifact-types.toml");
+	if (!existsSync(path)) return [];
+	return parseArtifactTypeMap(readFileSync(path, "utf8"));
+}
+function frontmatter(text) {
+	const m = /^---\n([\s\S]*?)\n---/.exec(text);
+	return m ? m[1].split("\n") : [];
+}
+const unquote = (s) => s.trim().replace(/^["']|["']$/g, "");
+function parseGovernanceFrontmatter(text) {
+	const lines = frontmatter(text);
+	let inMeta = false;
+	let artifactType = null;
+	let actor = null;
+	let gate = null;
+	let compose = "union";
+	for (const line of lines) {
+		if (/^metadata:\s*$/.test(line)) {
+			inMeta = true;
+			continue;
+		}
+		if (inMeta && /^\S/.test(line)) inMeta = false;
+		if (!inMeta) continue;
+		const at = /^\s+artifact-type:\s*(.+)$/.exec(line);
+		if (at) artifactType = unquote(at[1]);
+		const ac = /^\s+actor:\s*(.+)$/.exec(line);
+		if (ac) actor = unquote(ac[1]);
+		const ga = /^\s+gate:\s*(.+)$/.exec(line);
+		if (ga) gate = unquote(ga[1]);
+		const co = /^\s+compose:\s*(.+)$/.exec(line);
+		if (co) compose = unquote(co[1]) === "replace" ? "replace" : "union";
+	}
+	if (!actor || !gate) return null;
+	return {
+		artifactType,
+		actor,
+		gate,
+		compose
+	};
+}
+function collectAnchorGovernances(anchors) {
+	const out = [];
+	for (const { tier, root } of anchors) {
+		const dir = join(root, ".agents", "governances");
+		let entries;
+		try {
+			entries = readdirSync(dir, { withFileTypes: true });
+		} catch {
+			continue;
+		}
+		for (const e of entries) {
+			if (!e.isFile() || !e.name.endsWith(".md")) continue;
+			const meta = parseGovernanceFrontmatter(readFileSync(join(dir, e.name), "utf8"));
+			if (meta) out.push({
+				...meta,
+				tier,
+				path: join(root, ".agents", "governances", e.name)
+			});
+		}
+	}
+	return out;
+}
+function matchSquad(registry, artifactType) {
+	if (!artifactType) return {
+		match: null,
+		ambiguous: []
+	};
+	const matches = [];
+	for (const p of registry["sdd-plugins"]) for (const sq of p.squads ?? []) if (sq["artifact-types"]?.includes(artifactType)) matches.push({
+		plugin: p.name,
+		squad: sq
+	});
+	if (matches.length === 0) return {
+		match: null,
+		ambiguous: []
+	};
+	if (matches.length === 1) return {
+		match: matches[0],
+		ambiguous: []
+	};
+	return {
+		match: null,
+		ambiguous: [...new Set(matches.map((m) => m.plugin))]
+	};
+}
+function matchBar(artifactType, actor, gate, ctx) {
+	const key = `${actor}-${gate}`;
+	const bucket = (tier) => ctx.projectGovs.filter((c) => c.tier === tier && c.actor === actor && c.gate === gate).filter((c) => c.artifactType === artifactType || c.artifactType === null).map((c) => c.path);
+	const pluginBar = ctx.match?.squad.governances?.[key];
+	return {
+		key,
+		candidates: {
+			project: bucket("project"),
+			"project-root": bucket("project-root"),
+			plugin: ctx.match && pluginBar ? `${ctx.match.plugin}:${pluginBar}` : null,
+			sdd: `sdd:${key}-governance`
+		}
+	};
+}
+function resolveAgent(role, match) {
+	if (!match) return {
+		source: "sdd",
+		ref: SDD_DEFAULT_AGENT[role]
+	};
+	if (role in match.squad.roles) {
+		const named = match.squad.roles[role];
+		if (named) return {
+			source: "plugin",
+			ref: named
+		};
+		return {
+			source: "sdd",
+			ref: SDD_DEFAULT_AGENT[role]
+		};
+	}
+	return {
+		source: "plugin",
+		ref: `${match.plugin}-${role}`
+	};
+}
+function resolveRole(role, artifactType, ctx) {
+	const bars = ROLE_LOADOUT[role].bars.map((b) => {
+		const [actor, gate] = b.split("-");
+		return matchBar(artifactType, actor, gate, ctx);
+	});
+	return {
+		role,
+		agent: resolveAgent(role, ctx.match),
+		bars
+	};
+}
+function buildLoadPlan(artifactType, registry, projectGovs) {
+	const { match, ambiguous } = matchSquad(registry, artifactType);
+	if (ambiguous.length > 0) return {
+		artifactType,
+		status: "needs-input",
+		plugin: null,
+		ambiguous,
+		roles: []
+	};
+	const ctx = {
+		match,
+		projectGovs
+	};
+	return {
+		artifactType,
+		status: "complete",
+		plugin: match?.plugin ?? null,
+		ambiguous: [],
+		roles: ROLE_KEYS.map((r) => resolveRole(r, artifactType, ctx))
+	};
+}
+function validateRegistry(registry) {
+	const v = [];
+	const typeOwners = /* @__PURE__ */ new Map();
+	for (const entry of registry["sdd-plugins"]) {
+		const where = entry.name || "<unnamed plugin>";
+		if (!entry.name) v.push("an sdd-plugins entry has no name");
+		if (!Array.isArray(entry.squads)) {
+			v.push(`${where}: squads is not an array`);
+			continue;
+		}
+		const seenTypes = /* @__PURE__ */ new Set();
+		for (const sq of entry.squads) {
+			if (!Array.isArray(sq["artifact-types"])) v.push(`${where}: a squad's artifact-types is not an array`);
+			for (const r of Object.keys(sq.roles ?? {})) if (!ROLE_KEYS.includes(r)) v.push(`${where}: unknown role key "${r}"`);
+			for (const k of Object.keys(sq.governances ?? {})) if (!BAR_KEYS.includes(k)) v.push(`${where}: unknown governance key "${k}"`);
+			for (const t of sq["artifact-types"] ?? []) {
+				if (seenTypes.has(t)) v.push(`${where}: artifact-type "${t}" appears in more than one squad`);
+				seenTypes.add(t);
+			}
+		}
+		for (const t of seenTypes) typeOwners.set(t, [...typeOwners.get(t) ?? [], where]);
+	}
+	for (const [t, owners] of typeOwners) if (owners.length > 1) v.push(`artifact-type "${t}" is claimed by ${owners.length} plugins (${owners.join(", ")}) — ambiguous`);
+	return v;
+}
+function main(argv) {
+	const root = argv.includes("--root") ? argv[argv.indexOf("--root") + 1] : ".";
+	const explicitType = argv.includes("--artifact-type") ? argv[argv.indexOf("--artifact-type") + 1] : null;
+	const pathArg = argv.includes("--path") ? argv[argv.indexOf("--path") + 1] : null;
+	const projectArg = argv.includes("--project") ? argv[argv.indexOf("--project") + 1] : root;
+	const projectRootArg = argv.includes("--project-root") ? argv[argv.indexOf("--project-root") + 1] : null;
+	const anchors = [{
+		tier: "project",
+		root: projectArg
+	}];
+	if (projectRootArg) anchors.push({
+		tier: "project-root",
+		root: projectRootArg
+	});
+	let artifactType = explicitType;
+	if (!artifactType && pathArg) artifactType = resolveArtifactTypeFromMap(loadArtifactTypeMap(root), pathArg);
+	let registry;
+	try {
+		registry = loadRegistry(root);
+	} catch (e) {
+		console.error(`✗ ${e.message}`);
+		return 1;
+	}
+	if (!artifactType && pathArg) {
+		process.stdout.write(`${JSON.stringify({
+			path: pathArg,
+			artifactType: null,
+			note: "no tiebreaker match — classify by convention"
+		}, null, 2)}\n`);
+		return 0;
+	}
+	if (!artifactType) {
+		const violations = validateRegistry(registry);
+		if (violations.length) {
+			for (const line of violations) console.error(`✗ ${line}`);
+			return 1;
+		}
+		process.stdout.write("governance registry OK\n");
+		return 0;
+	}
+	const plan = buildLoadPlan(artifactType, registry, collectAnchorGovernances(anchors));
+	process.stdout.write(`${JSON.stringify(plan, null, 2)}\n`);
+	if (plan.status === "needs-input") console.error(`needs-input: artifact-type "${artifactType}" is claimed by ${plan.ambiguous.join(", ")}`);
+	return 0;
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) process.exit(main(process.argv.slice(2)));
+//#endregion
+export { ACTORS, BAR_KEYS, GATES, ROLE_KEYS, ROLE_LOADOUT, SDD_DEFAULT_AGENT, buildLoadPlan, collectAnchorGovernances, loadArtifactTypeMap, loadRegistry, main, matchBar, matchSquad, migrateEntry, parseArtifactTypeMap, parseGovernanceFrontmatter, parseRegistry, resolveAgent, resolveArtifactTypeFromMap, resolveRole, validateRegistry };

package/skills/resolve-tracking/SKILL.md

@@ -13,7 +13,7 @@ project spec's `intake` node (repo-only). For one touched artifact it decides **
 governs it — spec + gates) or **ignored** (SDD does not govern it; it still gets built) and
 reports which step decided it, so the conductor can skip a task outright (no CR, no draft, no
 gate, no record) when it resolves ignored. The split mirrors git's **tracked vs ignored** files.
-It carries a self-contained `.mts` script (the repo's node-≥23.6 / no-deps convention).
+It carries a self-contained `.mjs` script (compiled from `src/`; no runtime deps, Node ≥22.11).
 
 ## Run the resolution
 

package/skills/resolve-tracking/scripts/resolve-tracking.mjs

@@ -1,12 +1,152 @@
-// Launcher for the engine of the same name. Run it as `node <skill>/scripts/<engine>.mjs`.
-// A checkout runs the .mts source. An npm install keeps the skill under node_modules, where Node
-// will not strip types, so it runs the self-contained bundle built for the package.
-import { spawnSync } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
-
-const self = fileURLToPath(import.meta.url)
-const installed = /[\\/]node_modules[\\/]/.test(self)
-const target = self.replace(/\.mjs$/, installed ? '.bundle.mjs' : '.mts')
-const run = spawnSync(process.execPath, [...process.execArgv, target, ...process.argv.slice(2)], { stdio: 'inherit' })
-if (run.error) throw run.error
-process.exitCode = run.status ?? 1
+// Compiled by `universal-plugin plugin build` from src/resolve-tracking/resolve-tracking.mts. Edit the source, not this file.
+globalThis.__SKILL_SCRIPT__ = {"package":null,"bin":null,"version":"0.7.2","entry":"skills/resolve-tracking/scripts/resolve-tracking.mjs","commands":{}};
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+//#region src/resolve-tracking/resolve-tracking.mts
+function globToRegExpBody(glob) {
+	return glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*+/g, (m) => m.length > 1 ? ".*" : "[^/]*").replace(/\?/g, "[^/]");
+}
+function parseIgnoreLine(raw) {
+	const trimmed = raw.replace(/\r$/, "").trim();
+	if (!trimmed || trimmed.startsWith("#")) return "skip";
+	let body = trimmed;
+	const negated = body.startsWith("!");
+	if (negated) body = body.slice(1);
+	if (body.endsWith("/")) body = body.slice(0, -1);
+	let anchored = false;
+	if (body.startsWith("/")) {
+		anchored = true;
+		body = body.slice(1);
+	} else if (body.includes("/")) anchored = true;
+	if (body === "") return null;
+	const prefix = anchored ? "^" : "^(?:.*/)?";
+	const core = globToRegExpBody(body);
+	const suffix = "(?:/.*)?$";
+	try {
+		return {
+			negated,
+			regex: new RegExp(prefix + core + suffix),
+			source: trimmed
+		};
+	} catch {
+		return null;
+	}
+}
+function parseIgnoreFile(text) {
+	const out = [];
+	for (const raw of text.split("\n")) {
+		const rule = parseIgnoreLine(raw);
+		if (rule && rule !== "skip") out.push(rule);
+	}
+	return out;
+}
+function loadIgnoreRules(root) {
+	const path = join(root, ".agents", "sdd", ".sddignore");
+	if (!existsSync(path)) return [];
+	return parseIgnoreFile(readFileSync(path, "utf8"));
+}
+function resolveFromIgnore(rules, path) {
+	let value = null;
+	for (const rule of rules) if (rule.regex.test(path)) value = rule.negated ? "tracked" : "ignored";
+	return value;
+}
+const KIND_DEFAULT_GLOBS = {
+	skill: {
+		ignored: [".agents/skills/**"],
+		tracked: [
+			"skills/**",
+			"plugins/*/skills/**",
+			"packages/*/skills/**"
+		]
+	},
+	subagent: {
+		ignored: [".agents/agents/**"],
+		tracked: ["plugins/*/agents/**", "packages/*/agents/**"]
+	},
+	command: {
+		ignored: [".agents/commands/**"],
+		tracked: ["plugins/*/commands/**", "packages/*/commands/**"]
+	}
+};
+function globMatch(glob, path) {
+	return new RegExp(`^${globToRegExpBody(glob)}$`).test(path);
+}
+function resolveKindDefault(artifactType, path) {
+	if (!artifactType) return null;
+	const kind = KIND_DEFAULT_GLOBS[artifactType];
+	if (!kind) return null;
+	if (kind.ignored.some((g) => globMatch(g, path))) return "ignored";
+	if (kind.tracked.some((g) => globMatch(g, path))) return "tracked";
+	return null;
+}
+function resolveTracking(input) {
+	if (input.explicit) return {
+		value: input.explicit,
+		reason: "explicit override"
+	};
+	const ignoreMatch = resolveFromIgnore(loadIgnoreRules(input.root), input.path);
+	if (ignoreMatch) return {
+		value: ignoreMatch,
+		reason: ".sddignore"
+	};
+	const kindDefault = resolveKindDefault(input.artifactType, input.path);
+	if (kindDefault) return {
+		value: kindDefault,
+		reason: `kind-default (${input.artifactType})`
+	};
+	return {
+		value: "tracked",
+		reason: "fail-closed (no signal)"
+	};
+}
+function validateIgnoreFile(root) {
+	const path = join(root, ".agents", "sdd", ".sddignore");
+	if (!existsSync(path)) return {
+		ok: true,
+		message: ".sddignore OK (absent, fine)"
+	};
+	const text = readFileSync(path, "utf8");
+	const notes = [];
+	text.split("\n").forEach((raw, i) => {
+		if (parseIgnoreLine(raw) === null) notes.push(`line ${i + 1}: not a valid gitignore pattern: ${raw.trim()}`);
+	});
+	if (notes.length > 0) return {
+		ok: false,
+		message: notes.join("\n")
+	};
+	return {
+		ok: true,
+		message: `.sddignore OK (${parseIgnoreFile(text).length} rule(s))`
+	};
+}
+function parseArgs(argv) {
+	const out = {};
+	for (let i = 0; i < argv.length; i++) if (argv[i].startsWith("--")) {
+		out[argv[i].slice(2)] = argv[i + 1];
+		i++;
+	}
+	return out;
+}
+function main(argv) {
+	const args = parseArgs(argv);
+	const root = args.root ?? ".";
+	if (!args.path) {
+		const result = validateIgnoreFile(root);
+		process.stdout.write(`${result.message}\n`);
+		if (!result.ok) process.exitCode = 1;
+		return;
+	}
+	const explicit = args.explicit === "tracked" || args.explicit === "ignored" ? args.explicit : void 0;
+	const result = resolveTracking({
+		root,
+		path: args.path,
+		artifactType: args["artifact-type"],
+		explicit
+	});
+	process.stdout.write(`${result.value}\n`);
+	process.stdout.write(`reason: ${result.reason}\n`);
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) main(process.argv.slice(2));
+//#endregion
+export { loadIgnoreRules, main, parseIgnoreFile, parseIgnoreLine, resolveFromIgnore, resolveKindDefault, resolveTracking, validateIgnoreFile };

package/skills/scaffold-project-spec/SKILL.md

@@ -168,7 +168,7 @@ In the same act that writes root `spec.md`, record both so a later edit reads, n
   cross-cutting `concept → its nodes` view. Reserve the block; **leave it for `concept-index` to
   generate** from `concept:` frontmatter — pure derivation, never hand-maintained.
 
-Validate the result with the `spec-gate` skill's `check-spec-state` script (`check-spec-state.mts --root
+Validate the result with the `spec-gate` skill's `check-spec-state` script (`check-spec-state.mjs --root
 <specs-dir>`): the root lifecycle tuple must be legal.
 
 ## 6 — Hand back

package/skills/spec-gate/README.md

@@ -1,7 +1,7 @@
 # spec-gate
 
 Internal SDD skill that runs the **spec gate** (Draft → Approved) over a CR's spec + suite
-**diff**. It runs the deterministic structural checks (`scripts/check-spec-state.mts` — the root
+**diff**. It runs the deterministic structural checks (`scripts/check-spec-state.mjs` — the root
 lifecycle tuple + the per-node `spec-type` reconcile) and the provenance structural checks first
 (fail-closed on malformed `produced-by` / no resolvable producer; flag-only on uninstalled
 producers), then — running **in-session** as the conductor at the gate — **spawns a distinct cold
@@ -18,18 +18,21 @@ frontmatter and never fixes issues automatically.
 References `sdd:lifecycle-governance`, `sdd:ownership-governance`, `sdd:gate-validation-governance`,
 `sdd:combat-log-governance` (provenance/freeze shapes), and the conductor's autonomy bar.
 
-## scripts/
+## Engines
+
+Source and tests are in `plugins/sdd/src/spec-gate/`; `universal-plugin plugin build` compiles each
+engine into `scripts/<engine>.mjs`, which is what the skill runs.
 
 - `check-spec-state.mts` — deterministic state validator (root tuple + per-node spec-type
   reconcile); run via `pnpm verify:specs-new`. Tested by `check-spec-state.test.mts`.
 - `check-suite.mts` — deterministic `.feature`-form validator (Gherkin validity, boolean-`Then`
   form, scenario ordering); run via `pnpm verify:specs-new`. Tested by `check-suite.test.mts`.
-  It imports gherkin-cli from `../vendor/gherkin-cli.mjs`, a committed self-contained bundle, so it
-  runs from an installed plugin, which has no `node_modules`. `pnpm build:vendor` rebuilds the
-  bundle; `check-suite-installed.test.mts` runs the engine from a copy of the plugin's files and
-  fails while the bundle is stale.
+  The build inlines gherkin-cli from `src/vendor/gherkin-cli.mjs`, a committed self-contained
+  bundle, so the compiled script runs from an installed plugin, which has no `node_modules`.
+  `pnpm --filter cyber-sdd build:vendor` rebuilds the bundle; `check-suite-installed.test.mts`
+  runs the engine from a copy of the plugin's files and fails while the bundle is stale.
 - `classify-edit-class.mts` — the structural edit-class classifier for touched frozen `.feature`
-  files. It imports the same `../vendor/gherkin-cli.mjs` bundle; `classify-edit-class-installed.test.mts`
+  files. The build inlines the same `src/vendor/gherkin-cli.mjs` bundle; `classify-edit-class-installed.test.mts`
   runs it from a copy of the plugin's files.
-- `vendor/gherkin-cli.mjs` is shared: `touch-set-correction` and `verify-scenarios` import it from
-  here too, so the plugin ships one copy.
+- `src/vendor/gherkin-cli.mjs` is shared: `touch-set-correction` and `verify-scenarios` inline it
+  too, so every compiled script stays self-contained.

package/skills/spec-gate/SKILL.md

@@ -35,7 +35,7 @@ carrying a `.feature` or missing its `## Subject`, and a `behavioral` node missi
 **fail closed**; a descriptive node (no marker) raises no violation. If `node` is unavailable,
 perform the same checks by reading each README's frontmatter yourself.
 
-The sibling `scripts/check-suite.mts` is the **`.feature`-form** authority — Gherkin validity,
+The sibling `scripts/check-suite.mjs` is the **`.feature`-form** authority — Gherkin validity,
 boolean-`Then` form (hedge-word + leaked-rubric detection), and scenario ordering/sectioning. When
 the CR touches any `.feature`, run it here **fail-closed, before spawning the cold judge**, scoped to
 the CR's touched files:
@@ -157,7 +157,7 @@ files keep their state. An **additive** scenario folds into a frozen file withou
 change is purely additive with no judge round; a **narrowing/rewriting** edit (a `modified`/`removed`
 scenario) unfreezes its file and fires **Clearance** once the narrowing is confirmed semantically.
 The edit-class classification itself — additive / no-content-change / narrowing / mixed — comes from
-`scripts/classify-edit-class.mts` (`--files <paths> [--base <ref>]`): a **structural** per-named-`Scenario`
+`scripts/classify-edit-class.mjs` (`--files <paths> [--base <ref>]`): a **structural** per-named-`Scenario`
 diff via the pinned `gherkin-cli@0.2.1 diff`, plus git rename detection for a pure `git mv`, **never a raw
 line diff** (a step orphaned off a frozen scenario onto a new adjacent scenario shows no `-` line and
 would read as additive to a line-diff; the structural diff correctly reports the losing scenario as