devmethod-ai 0.2.0 → 0.3.0

package/docs/missions/workflow-0.3-reviews/interface/review.json

@@ -0,0 +1,255 @@
+{
+  "format": 1,
+  "id": "REVIEW-UI-1",
+  "title": "Review de l’interface DevMethod",
+  "project": "DevMethod",
+  "mission": "workflow-0.3",
+  "tickets": [
+    {
+      "id": "PR-19",
+      "title": "Livraison du workflow et de la review",
+      "url": "https://github.com/montassarkhalloufi/DevMethod/pull/19"
+    }
+  ],
+  "date": "2026-09-13",
+  "scope": [
+    "Format de review, rendu sécurisé, navigation clavier/mobile et exports du candidat en cours."
+  ],
+  "exclusions": [
+    "Audit exhaustif WCAG avec lecteur d’écran",
+    "Exécution native du workflow conversationnel sur les trois hôtes"
+  ],
+  "revision": {
+    "commit": "8d7cd3584c891c04d983f85279e14a2070ab621d + working changes",
+    "dirty": [
+      "src/review-app.ts",
+      "src/review-model.ts",
+      "src/review-cli.ts",
+      "src/review.ts",
+      "src/review-ui.css",
+      "src/cli.ts"
+    ]
+  },
+  "technologies": [
+    {
+      "name": "TypeScript",
+      "version": "5.9.3",
+      "detectedFrom": "package-lock.json"
+    },
+    {
+      "name": "Node.js",
+      "version": "24.18.0 local / >=22 package",
+      "detectedFrom": "node --version / package.json"
+    }
+  ],
+  "sources": [
+    {
+      "id": "WAI-TABS",
+      "title": "Tabs Pattern",
+      "kind": "documentation",
+      "publisher": "W3C WAI",
+      "technology": "ARIA / DOM",
+      "version": "APG consulted 2026-09-13",
+      "url": "https://www.w3.org/WAI/ARIA/apg/patterns/tabs/",
+      "consultedAt": "2026-09-13",
+      "access": "consulted",
+      "usage": "Clavier, focus et association des onglets/panneaux.",
+      "compatibility": "Guide de conception ; ne certifie pas une conformité WCAG complète.",
+      "provenance": "Page du site officiel W3C consultée pendant cette session."
+    }
+  ],
+  "checks": [
+    {
+      "id": "UI-KEYBOARD",
+      "title": "Clavier et retour mobile",
+      "domain": "Interface",
+      "kind": "manual",
+      "status": "passed",
+      "result": "Focus après correction et conservation des filtres observés.",
+      "reason": null,
+      "evidenceIds": [
+        "E-FOCUS-AFTER"
+      ],
+      "revision": "8d7cd3584c891c04d983f85279e14a2070ab621d + working changes",
+      "targets": [
+        "finding-selection",
+        "tabs"
+      ]
+    },
+    {
+      "id": "UI-EXPORT",
+      "title": "Contenu de l’export HTML",
+      "domain": "Interface",
+      "kind": "manual",
+      "status": "passed",
+      "result": "Résultats, état de sélection et empreinte CSP vérifiés dans le dernier export Chrome.",
+      "reason": null,
+      "evidenceIds": [
+        "E-EXPORT"
+      ],
+      "revision": "8d7cd3584c891c04d983f85279e14a2070ab621d + working changes",
+      "targets": [
+        "export"
+      ]
+    },
+    {
+      "id": "UI-REOPEN",
+      "title": "Réouverture file://",
+      "domain": "Interface",
+      "kind": "manual",
+      "status": "blocked",
+      "result": "Non vérifiée dans le navigateur automatisé.",
+      "reason": "La politique de l’outil interdit cette navigation ; aucun contournement effectué.",
+      "evidenceIds": [],
+      "revision": "8d7cd3584c891c04d983f85279e14a2070ab621d + working changes",
+      "targets": [
+        "export"
+      ]
+    },
+    {
+      "id": "SEC-REDACTION",
+      "title": "Masquage des formats courants",
+      "domain": "Confidentialité",
+      "kind": "automated",
+      "status": "passed",
+      "result": "Régression Bearer, variable préfixée et valeur entre guillemets réussie.",
+      "reason": null,
+      "evidenceIds": [
+        "E-REDACTION"
+      ],
+      "revision": "fa84208 + redaction working changes",
+      "targets": [
+        "review-redaction"
+      ]
+    }
+  ],
+  "findings": [
+    {
+      "id": "FOCUS-01",
+      "title": "La sélection d’un constat perdait le focus clavier",
+      "domain": "Accessibilité",
+      "severity": "moderate",
+      "severityReason": "La navigation clavier quittait le contenu attendu et rendait la poursuite du parcours difficile.",
+      "confidence": "confirmed",
+      "resolution": "resolved",
+      "location": {
+        "path": "src/review-app.ts",
+        "line": null,
+        "component": "Sélection du constat et gestion de hashchange"
+      },
+      "trigger": "Activer un constat avec Enter quand le fragment de lien doit changer.",
+      "expected": "Le focus arrive sur le titre du détail et permet de poursuivre au clavier.",
+      "observed": "Avant correction, le rendu immédiat était suivi d’un deuxième rendu lors de hashchange ; le titre focalisé était remplacé.",
+      "impact": "L’utilisateur au clavier perdait son point de navigation.",
+      "reproduction": [
+        "Activer R-01 avec Enter depuis la liste.",
+        "Inspecter le focus après le changement du fragment."
+      ],
+      "evidenceIds": [
+        "E-FOCUS-BEFORE"
+      ],
+      "correction": "Mettre à jour le fragment avec history.pushState, rendre une seule fois, puis focaliser le titre. Restaurer aussi le focus après un changement d’onglet.",
+      "tradeoffs": "Écouter popstate séparément pour les navigations historiques.",
+      "sourceIds": [
+        "WAI-TABS"
+      ],
+      "ticketIds": [
+        "PR-19"
+      ],
+      "verification": "Enter conserve le focus sur detail-title ; ArrowRight cible Correction ; le retour mobile restaure la liste filtrée.",
+      "resolutionEvidenceIds": [
+        "E-FOCUS-AFTER"
+      ],
+      "targets": [
+        "finding-selection",
+        "tabs"
+      ]
+    },
+    {
+      "id": "REDACT-01",
+      "title": "Certains formats courants d’identifiants étaient partiellement masqués",
+      "domain": "Confidentialité",
+      "severity": "major",
+      "severityReason": "Un rapport distribué pouvait conserver une valeur sensible dans un header standard ou un champ entre guillemets. Aucun identifiant réel n’a été exposé dans ce test.",
+      "confidence": "confirmed",
+      "resolution": "resolved",
+      "location": {
+        "path": "src/review-model.ts",
+        "line": null,
+        "component": "redactReviewText"
+      },
+      "trigger": "Importer une preuve contenant un header Bearer ou une valeur sensible avec espaces.",
+      "expected": "Masquer la valeur complète des formats courants pris en charge.",
+      "observed": "La première règle arrêtait le masquage au premier espace et ne reconnaissait pas certains préfixes de variables.",
+      "impact": "Risque de divulguer une valeur sensible dans une copie de rapport si la revue de confidentialité ne la détecte pas.",
+      "reproduction": [
+        "Utiliser exclusivement les cas synthétiques du test de régression du masquage."
+      ],
+      "evidenceIds": [
+        "E-REDACTION"
+      ],
+      "correction": "Reconnaître les schémas Bearer/Basic, les valeurs entre guillemets et les clés préfixées avant de produire la copie distribuée.",
+      "tradeoffs": "Le masquage reste heuristique ; la confidentialité des images et des formats inconnus exige une inspection avant partage.",
+      "sourceIds": [],
+      "ticketIds": [
+        "PR-19"
+      ],
+      "verification": "Les valeurs synthétiques de ces trois formats sont absentes de sanitizedReview ; le document original reste inchangé.",
+      "resolutionEvidenceIds": [
+        "E-REDACTION"
+      ],
+      "targets": [
+        "review-redaction"
+      ]
+    }
+  ],
+  "evidence": [
+    {
+      "id": "E-FOCUS-BEFORE",
+      "title": "Observation réelle avant correction",
+      "kind": "log",
+      "content": "Navigateur intégré, 2026-09-13 : activation clavier du constat R-01 puis lecture du focus. Résultat observé : document.activeElement.id vide après le second rendu déclenché par hashchange. Le lien direct devenait #finding=R-01. Observation manuelle de cette session, pas un journal de test CI.",
+      "url": null,
+      "image": null
+    },
+    {
+      "id": "E-FOCUS-AFTER",
+      "title": "Vérification réelle après correction",
+      "kind": "log",
+      "content": "Navigateur intégré, 2026-09-13 : Enter sur le constat => focus detail-title. ArrowRight sur Preuve => focus detail-content-correction. En mobile 390x844, retour => focus sur le constat choisi ; query=silencieux et confidence=confirmed conservés ; aucun débordement horizontal.",
+      "url": null,
+      "image": null
+    },
+    {
+      "id": "E-EXPORT",
+      "title": "Export Chrome inspecté sur disque",
+      "kind": "text",
+      "content": "Le dernier export Chrome possède review format 1, uiState.selected=R-01, filters.query=silencieux et section=correction. Les données ont été validées et l’empreinte SHA-256 du programme correspond à la CSP. Réouverture navigateur file:// non exécutée : politique de l’outil.",
+      "url": null,
+      "image": null
+    },
+    {
+      "id": "E-REDACTION",
+      "title": "Régression automatisée du masquage des identifiants",
+      "kind": "log",
+      "content": "Cas synthétiques : header Authorization avec Bearer, variable NPM_TOKEN et mot de passe entre guillemets contenant des espaces. Avant correction, la règle masquait seulement une partie de certaines valeurs. Le test dédié vérifie maintenant que les trois valeurs synthétiques sont totalement absentes de la source distribuée. Exécuté dans npm test : réussite.",
+      "url": null,
+      "image": null
+    }
+  ],
+  "limits": [
+    "La réouverture directe file:// est bloquée par la politique du navigateur de test ; elle n’est pas annoncée comme vérifiée.",
+    "Les tests de format ne prouvent ni la vérité des preuves fournies ni le comportement d’un agent de review.",
+    "Le mode d’ouverture final reste à choisir avant publication."
+  ],
+  "policy": {
+    "blockingSeverities": [
+      "critical",
+      "major",
+      "moderate"
+    ],
+    "requireAllChecks": true,
+    "rationale": "Corriger les défauts confirmés affectant le parcours et vérifier les contrôles de livraison avant publication."
+  },
+  "summary": "Le défaut de focus observé a été corrigé et revérifié. La validation de livraison reste incomplète, avec ses limites explicites."
+}

package/docs/missions/workflow-0.3.md

@@ -0,0 +1,17 @@
+# Workflow and review delivery — 0.3.0
+
+Owner: current implementation session. Authorized scope: improve explore, architecture, plan, mission ownership and review; deliver a functional browser review interface, package, PR, merge after checks, GitHub release and npm publication. Preserve approved design behavior, existing project conventions and user files. The user supplied a validated visual direction for the review screen; its example findings are not real evidence.
+
+This repository already uses single-file mission records, so retain that convention for this delivery. The user added the review scope before publication; PR #19 remains the same delivery. Existing checks for the earlier commit are historical, not validation of the added interface.
+
+## Executable scope and ownership
+
+- Workflow guidance and mission templates: implemented; evidence and migration details in [workflow validation](../WORKFLOW-0.3-VALIDATION.md) and [migration](../WORKFLOW-0.3.md).
+- Review record, derived report, browser interface and CLI: active. Acceptance: validated versioned records; consistent counters/filters; finding/check separation; evidence and official-source provenance; safe rendering; list/detail and direct links; export/reopen; explicit empty/invalid/partial/historical states; responsive keyboard use; distribution independent of the source checkout.
+- Delivery: [PR #19](https://github.com/montassarkhalloufi/DevMethod/pull/19). CI/package proofs belong in the PR and release record. The actual review results are owned by [review.json](workflow-0.3-reviews/interface/review.json), with a generated report; do not duplicate finding status here.
+
+Exclusions: whole-project dashboard, remote hosting, automatic discovery/installation/execution of third-party skills, automatic code review execution, arbitrary filesystem browsing, destructive migration, changes to the approved design workflow.
+
+Current architecture question: static self-contained HTML versus loopback server; recommended static report under the dependency-free offline contract, presented to the user before dependent implementation. Preserve their forthcoming choice/delegation in the relevant ADR.
+
+Next action: verify the final delegated offline-opening integration, merge and publish under current authorization. The user explicitly delegated the opening-mode choice on 2026-09-13; ADR 008 records the selected standalone HTML and optional OS opening command. Shared model, report/export, CLI presentation and browser UI are implemented. The file:// browser reopening limitation remains documented; do not bypass the browser tool policy or claim that check passed.

package/examples/mission-dialogue/PROJECT_PROFILE.md

@@ -0,0 +1,9 @@
+# Reading list — fictional workflow fixture
+
+Outcome: let a reader save a title and retrieve it later. This is an illustrative authored fixture, not a delivered product or a real conversation transcript.
+Cross-cutting constraints: one maintainer, modest operating budget, hosting undecided.
+Active mission: [first save](docs/missions/first-save/PLAN.md).
+Product rules: [rules](docs/produit/REGLES.md).
+Open architecture: [storage](architecture/decisions/001-storage.md).
+Research: not executed; no market or price claims are made.
+Read the mission, then the active ticket and only its linked rules/decision. A legacy record is also [illustrated](docs/missions/legacy-copy.md); it is a separate mission, not another tracker of first-save.

package/examples/mission-dialogue/architecture/decisions/001-storage.md

@@ -0,0 +1,7 @@
+# Storage decision
+
+Status: PROPOSED. No choice or delegation has been received in this fixture.
+Constraints: single maintainer; hosting and multi-device requirement unresolved.
+Conversation brief to present: local storage offers a small single-device slice; server persistence can support multiple devices but adds hosting and operation. Recommendation depends on the multi-device requirement and data-loss tolerance. No current price claim.
+Ask the user to challenge, offer an alternative, choose or delegate. Evaluate any alternative against the same durability, operations, cost and access criteria.
+Dependent architecture stays open. Revisit after the requirement or budget changes. Record the actual choice/delegation and rationale here before detailing dependent architecture.

package/examples/mission-dialogue/docs/missions/first-save/PLAN.md

@@ -0,0 +1,13 @@
+# First useful save
+
+Owner: fictional maintainer. Outcome: save one title and find it again. Learning: whether this smallest journey is useful enough to extend.
+Proposed scope: one title field and retrieval; exclude accounts, tagging and sharing. No artificial second delivery option is needed until a real competing priority emerges.
+Effort: not estimated until runtime and persistence are chosen; main uncertainty is multi-device storage and deployment.
+Scope conversation pending: invite the user to add, remove, move or split scope. No priorities have been accepted in this authored fixture.
+Conditional dependency: [storage decision](../../../architecture/decisions/001-storage.md).
+
+| Milestone | Demonstration | Exit criteria | Continuation conditions | Ordered tickets |
+|---|---|---|---|---|
+| First useful save | Save and retrieve one title; reject blank input | Ticket criteria pass on the selected persistence contract | Continue only agreed scope; reassess after a changed storage decision | [SAVE-1](tickets/SAVE-1.md) |
+
+Ticket owns current execution state and evidence. [Latest handoff](REPRISE.md).

package/examples/mission-dialogue/docs/missions/first-save/REPRISE.md

@@ -0,0 +1,6 @@
+# Latest handoff
+
+Captured: 2026-09-13, authored fixture, no implementation revision.
+Read [profile](../../../PROJECT_PROFILE.md), [mission](PLAN.md), then [active ticket](tickets/SAVE-1.md).
+Last action: prepared a conditional milestone and acceptance examples; no tests executed.
+Next action: resume the [storage exchange](../../../architecture/decisions/001-storage.md). Ticket owns the blocker; reconcile it before dependent implementation. This snapshot grants no new authorization.

package/examples/mission-dialogue/docs/missions/first-save/tickets/SAVE-1.md

@@ -0,0 +1,14 @@
+# SAVE-1
+
+Owner: fictional maintainer. [Milestone](../PLAN.md).
+Outcome/value: retain a title for later retrieval.
+Included: save and retrieve a title. Excluded: accounts, tags, sharing.
+Status: conditional.
+Dependencies/blocker: [storage choice](../../../../architecture/decisions/001-storage.md), owned by the maintainer, unresolved.
+Rule: [R-01](../../../produit/REGLES.md#r-01--save-a-title).
+Screen: no approved screen required by this nonvisual fixture; resolve design if visual scope is added.
+Contract: persistence contract awaits the storage decision.
+Acceptance AC-01: a valid saved title is retrievable. AC-02: whitespace-only input is rejected.
+Verification: not run; there is no implementation or inspected code revision. Proposed check is a save/retrieve and blank-input test under the selected contract.
+Review/integration/deployment: not performed.
+Next action: resume the storage decision exchange in architecture; independent work may refine input examples.

package/examples/mission-dialogue/docs/missions/legacy-copy.md

@@ -0,0 +1,9 @@
+# Legacy mission — improve copy
+
+This separate, fictional single-file mission remains usable without moving it into a directory.
+Outcome/scope: clarify one empty-state message; exclude behavior changes.
+Task COPY-1 / owner: maintainer / status: proposed.
+Criterion COPY-AC1: the message explains the next available action.
+Evidence: not run, no implementation revision.
+Next action: inspect the current wording and apply the authorized text edit.
+Latest handoff: 2026-09-13, fixture prepared; this section references the task above rather than duplicating its status.

package/examples/mission-dialogue/docs/produit/REGLES.md

@@ -0,0 +1,5 @@
+# Reading list rules
+
+## R-01 — Save a title
+
+A non-empty title can be saved and retrieved; whitespace-only input is rejected. This is an assumed fixture requirement, not user research.

package/examples/review/review.json

@@ -0,0 +1,199 @@
+{
+  "format": 1,
+  "id": "DEMO-REVIEW",
+  "title": "Review de la bibliothèque",
+  "project": "Atelier de lecture",
+  "mission": "Première sauvegarde",
+  "tickets": [
+    {
+      "id": "DEMO-12",
+      "title": "PR de l’interface (lien de démonstration)",
+      "url": "https://github.com/montassarkhalloufi/DevMethod/pull/19"
+    }
+  ],
+  "date": "2026-09-13",
+  "scope": [
+    "Démonstration fictive de consultation, sans audit du projet illustré."
+  ],
+  "exclusions": [
+    "Aucun résultat réel de sécurité ou de performance."
+  ],
+  "revision": {
+    "commit": "demo-revision-1",
+    "dirty": []
+  },
+  "technologies": [
+    {
+      "name": "HTML / DOM",
+      "version": "Living Standard",
+      "detectedFrom": "Fixture authored for the viewer"
+    }
+  ],
+  "sources": [
+    {
+      "id": "WAI",
+      "title": "Messages de statut accessibles",
+      "kind": "documentation",
+      "publisher": "W3C WAI",
+      "technology": "Web accessibility",
+      "version": "WCAG 2.2",
+      "url": "https://www.w3.org/WAI/WCAG22/Understanding/status-messages.html",
+      "consultedAt": null,
+      "access": "unverified",
+      "usage": "Référence proposée pour cette démonstration, non consultée dans une review réelle.",
+      "compatibility": "À vérifier pour le parcours cible.",
+      "provenance": "Domaine w3.org ; cette fixture ne constitue pas une vérification de provenance."
+    }
+  ],
+  "checks": [
+    {
+      "id": "C-01",
+      "title": "Annonce après sauvegarde",
+      "domain": "Accessibilité",
+      "kind": "manual",
+      "status": "failed",
+      "result": "Exemple fictif : le changement de statut ne serait pas annoncé.",
+      "reason": null,
+      "evidenceIds": [
+        "E-01"
+      ],
+      "revision": "demo-revision-1",
+      "targets": [
+        "save-status"
+      ]
+    },
+    {
+      "id": "C-02",
+      "title": "Conservation du titre",
+      "domain": "Données",
+      "kind": "automated",
+      "status": "passed",
+      "result": "Exemple fictif : la valeur enregistrée correspond à la saisie.",
+      "reason": null,
+      "evidenceIds": [
+        "E-02"
+      ],
+      "revision": "demo-revision-1",
+      "targets": [
+        "save-title"
+      ]
+    },
+    {
+      "id": "C-03",
+      "title": "Temps de réponse sur liste longue",
+      "domain": "Performance",
+      "kind": "automated",
+      "status": "not-run",
+      "result": "Aucune mesure disponible dans cette fixture.",
+      "reason": "Jeu de données représentatif indisponible.",
+      "evidenceIds": [],
+      "revision": "demo-revision-1",
+      "targets": [
+        "list-view"
+      ]
+    }
+  ],
+  "findings": [
+    {
+      "id": "R-01",
+      "title": "Le retour de sauvegarde reste silencieux",
+      "domain": "Accessibilité",
+      "severity": "moderate",
+      "severityReason": "Exemple fictif : le lecteur pourrait ignorer que son action a réussi.",
+      "confidence": "confirmed",
+      "resolution": "open",
+      "location": {
+        "path": "save-status (composant fictif)",
+        "line": null,
+        "component": "Confirmation de sauvegarde"
+      },
+      "trigger": "Sauvegarder un titre en utilisant un lecteur d’écran.",
+      "expected": "Le succès est annoncé sans déplacer le focus.",
+      "observed": "Dans ce scénario fictif, seul le texte visuel change.",
+      "impact": "Le lecteur ne sait pas si son titre a été conservé.",
+      "reproduction": [
+        "Scénario illustratif, non exécuté.",
+        "Saisir un titre, activer Sauvegarder et écouter le retour."
+      ],
+      "evidenceIds": [
+        "E-01"
+      ],
+      "correction": "Exposer le message de succès comme statut accessible, puis vérifier son annonce.",
+      "tradeoffs": "Éviter les annonces répétées ; conserver le focus dans le parcours.",
+      "sourceIds": [
+        "WAI"
+      ],
+      "ticketIds": [
+        "DEMO-12"
+      ],
+      "verification": "Inspecter avec un lecteur d’écran réel et vérifier le maintien du focus.",
+      "resolutionEvidenceIds": [],
+      "targets": [
+        "save-status"
+      ]
+    },
+    {
+      "id": "R-02",
+      "title": "Une grande liste pourrait ralentir la recherche",
+      "domain": "Performance",
+      "severity": "minor",
+      "severityReason": "Impact supposé limité aux collections volumineuses.",
+      "confidence": "suspected",
+      "resolution": "open",
+      "location": {
+        "path": "list-view (composant fictif)",
+        "line": null,
+        "component": "Liste de titres"
+      },
+      "trigger": "Rechercher dans une collection volumineuse.",
+      "expected": "La saisie reste réactive.",
+      "observed": "Aucune mesure ; risque hypothétique seulement.",
+      "impact": "Un délai pourrait gêner la saisie ; cela reste à vérifier.",
+      "reproduction": [
+        "Préparer un jeu représentatif puis mesurer ; non exécuté."
+      ],
+      "evidenceIds": [],
+      "correction": "Mesurer avant de décider d’une optimisation.",
+      "tradeoffs": "Éviter une complexité non justifiée par des mesures.",
+      "sourceIds": [],
+      "ticketIds": [],
+      "verification": "Mesurer latence et réactivité sur le matériel cible.",
+      "resolutionEvidenceIds": [],
+      "targets": [
+        "list-view"
+      ]
+    }
+  ],
+  "evidence": [
+    {
+      "id": "E-01",
+      "title": "Flux du retour utilisateur — schéma explicatif",
+      "kind": "diagram",
+      "content": "Saisie du titre → Sauvegarder → Titre conservé → Message visuel\n                                      ↳ Annonce vocale manquante (hypothèse de fixture)\nSchéma explicatif fictif, pas une capture ni un journal d’exécution.",
+      "url": null,
+      "image": null
+    },
+    {
+      "id": "E-02",
+      "title": "Résultat illustratif de conservation",
+      "kind": "log",
+      "content": "DÉMONSTRATION — journal rédigé, test non exécuté.\nEntrée « Un titre » → valeur conservée « Un titre ».",
+      "url": null,
+      "image": null
+    }
+  ],
+  "limits": [
+    "DÉMONSTRATION : données fictives, sans validation d’un produit réel.",
+    "Le contrôle de performance n’a pas été exécuté."
+  ],
+  "policy": {
+    "blockingSeverities": [
+      "critical",
+      "major",
+      "moderate"
+    ],
+    "requireAllChecks": true,
+    "rationale": "Politique illustrative : corriger les problèmes confirmés modérés ou plus graves avant intégration."
+  },
+  "summary": "Démonstration de l’interface. Les constats et contrôles ci-dessous sont fictifs."
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devmethod-ai",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "From idea to delivery with your AI coding agents",
   "license": "MIT",
   "type": "module",
@@ -28,7 +28,7 @@
     "url": "git+https://github.com/montassarkhalloufi/DevMethod.git"
   },
   "scripts": {
-    "build": "tsc",
+    "build": "tsc && node scripts/build-review.mjs",
     "test": "npm run build && node --test tests/*.test.mjs",
     "test:fixtures": "node --test tests/evaluation.test.mjs",
     "check:docs": "node scripts/check-docs.mjs",

package/scripts/build-review.mjs

@@ -0,0 +1,8 @@
+// The two browser modules have no runtime dependencies. Keep this bundle explicit.
+import fs from 'node:fs';
+const model = fs.readFileSync('dist/review-model.js', 'utf8').replace(/\r\n/g, '\n');
+const app = fs.readFileSync('dist/review-app.js', 'utf8').replace(/\r\n/g, '\n');
+if (/^import /m.test(model) || (app.match(/^import /gm) || []).length !== 1 || !app.includes("from './review-model.js'")) throw new Error('Review browser dependencies changed; inspect bundling.');
+const code = `(function () {\n'use strict';\n${model.replace(/^export /gm, '')}\n${app.replace(/^import .*;\n/m, '')}\n})();\n`;
+fs.writeFileSync('dist/review-browser.js', code);
+fs.copyFileSync('src/review-ui.css', 'dist/review-ui.css');

package/scripts/package-smoke.mjs

@@ -15,8 +15,21 @@ try {
   run('tar', ['-xzf', '-'], root, 0, fs.readFileSync(path.resolve(archive)));
   const pkg = path.join(root, 'package'); const cli = path.join(pkg, 'dist/cli.js');
   const call = (args, expected = 0) => run(process.execPath, [cli, ...args], root, expected);
-  assert.equal(JSON.parse(fs.readFileSync(path.join(pkg, 'package.json'))).version, '0.2.0');
+  assert.equal(JSON.parse(fs.readFileSync(path.join(pkg, 'package.json'))).version, '0.3.0');
   run(process.execPath, ['scripts/check-docs.mjs'], pkg);
+  assert.match(call(['--help']), /Markdown PLAN\/tickets and legacy missions/);
+  for (const resource of ['project-foundation/references/exploration.md', 'project-foundation/references/delivery-planning.md', 'project-foundation/assets/EXISTANT.md', 'project-foundation/assets/OPPORTUNITES.md', 'project-foundation/assets/CADRAGE.md', 'project-foundation/assets/REGLES.md', 'scoped-delivery/assets/PLAN.md', 'scoped-delivery/assets/TICKET.md', 'scoped-delivery/assets/REPRISE.md', 'scoped-delivery/assets/MISSION.md', 'scoped-delivery/assets/REVIEW.md', 'scoped-delivery/references/review-workflow.md']) {
+    assert.ok(fs.statSync(path.join(pkg, '.agents/skills', resource)).size > 0, resource);
+  }
+  assert.ok(fs.existsSync(path.join(pkg, 'examples/mission-dialogue/docs/missions/first-save/tickets/SAVE-1.md')));
+  for (const file of ['review.js', 'review-cli.js', 'review-model.js', 'review-browser.js', 'review-ui.css']) assert.ok(fs.statSync(path.join(pkg, 'dist', file)).size > 0, file);
+  const reviewRoot = path.join(root, 'review-output');
+  const reviewResult = JSON.parse(call(['review', '--demo', '--dest', reviewRoot, '--output', 'review.html', '--markdown', 'REVIEW.md', '--json']));
+  assert.equal(reviewResult.status, 'corrections');
+  assert.ok(fs.readFileSync(path.join(reviewRoot, 'review.html'), 'utf8').includes('Content-Security-Policy'));
+  assert.ok(fs.readFileSync(path.join(reviewRoot, 'REVIEW.md'), 'utf8').includes('R-01'));
+  call(['review', '--demo', '--dest', reviewRoot, '--output', 'review.html'], 2);
+
   for (const testFile of [...fs.readdirSync(path.join(pkg, 'examples/pocket-tasks/tests')).filter(f => f.endsWith('.test.mjs')).map(f => `examples/pocket-tasks/tests/${f}`), 'evaluation/greenfield/acceptance.test.mjs', 'evaluation/greenfield/security.test.mjs']) {
     run(process.execPath, ['--test', testFile], pkg);
   }
@@ -55,10 +68,10 @@ try {
     const before = [fs.readFileSync(customized), fs.readFileSync(profile)];
     const preview = JSON.parse(call(['update-preview', '--dest', adopted, '--json']));
     assert.equal(preview.entries.find(e => e.path === '.agents/skills/project-foundation/SKILL.md').classification, 'conflict');
-    assert.equal(preview.provenance, 'unknown');
+    assert.equal(preview.provenance, JSON.parse(fs.readFileSync(path.join(adopted, 'kit-manifest.json'))).provenance ? 'recorded' : 'unknown');
     call(['init', '--tool', 'codex', '--dest', adopted], 2);
     assert.deepEqual([fs.readFileSync(customized), fs.readFileSync(profile)], before);
     console.log('Actual legacy tarball: local/upstream conflict detected and filled profile/custom skill preserved.');
   }
-  console.log('Packed 0.2.0: three host installs, subset, customization preservation, mission/context/staleness/planning and documentation links passed. No native host execution.');
+  console.log('Packed 0.3.0: three host installs, subset, customization preservation, mission/context/staleness/planning and documentation links passed. No native host execution.');
 } finally { fs.rmSync(root, { recursive: true, force: true }); }