dic-workflow-kit 1.1.2 → 1.1.4

package/schemas/ontology-snapshot.schema.json

@@ -0,0 +1,326 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://dicworkflowkit.local/schemas/ontology-snapshot.schema.json",
+  "title": "DIC Ontology Snapshot",
+  "description": "Portable, file-backed semantic graph for design-implementation consistency.",
+  "type": "object",
+  "required": [
+    "schema",
+    "version",
+    "snapshotId",
+    "projectRoot",
+    "objects",
+    "links",
+    "invariantResults"
+  ],
+  "properties": {
+    "schema": { "const": "dic.ontology-snapshot.v1" },
+    "version": { "type": "string" },
+    "snapshotId": { "$ref": "#/$defs/stableId" },
+    "snapshotRevision": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "projectRoot": { "type": "string" },
+    "objects": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/object" }
+    },
+    "links": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/link" }
+    },
+    "invariantResults": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/invariantResult" }
+    },
+    "appliedActionIds": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "pattern": "^act-[a-zA-Z0-9._:-]+$"
+      },
+      "uniqueItems": true
+    }
+  },
+  "$defs": {
+    "stableId": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9-]*-[a-zA-Z0-9._:-]+$"
+    },
+    "lifecycle": {
+      "enum": [
+        "draft",
+        "confirmed",
+        "active",
+        "deprecated",
+        "superseded",
+        "rejected",
+        "open",
+        "approved",
+        "in_progress",
+        "resolved",
+        "blocked"
+      ]
+    },
+    "provenance": {
+      "type": "object",
+      "required": ["source", "sourceRevision", "createdBy"],
+      "properties": {
+        "source": { "type": "string", "minLength": 1 },
+        "sourceLocator": { "type": "string" },
+        "sourceRevision": { "type": "string", "minLength": 1 },
+        "contentHash": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "createdBy": { "type": "string", "minLength": 1 },
+        "runId": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "object": {
+      "type": "object",
+      "required": ["id", "type", "lifecycle", "properties", "provenance"],
+      "properties": {
+        "id": { "$ref": "#/$defs/stableId" },
+        "type": {
+          "enum": [
+            "Project",
+            "DesignSource",
+            "Change",
+            "Requirement",
+            "Scenario",
+            "ImplementationUnit",
+            "Gap",
+            "RepairAction",
+            "Validation",
+            "Evidence",
+            "AgentRun",
+            "Decision",
+            "Risk",
+            "Candidate",
+            "GateRun",
+            "Claim",
+            "Challenge",
+            "Counterexample",
+            "Waiver",
+            "Policy"
+          ]
+        },
+        "lifecycle": { "$ref": "#/$defs/lifecycle" },
+        "interfaces": {
+          "type": "array",
+          "items": {
+            "enum": [
+              "SourceBacked",
+              "Verifiable",
+              "Versioned",
+              "GovernedMutation",
+              "ContentAddressed"
+            ]
+          },
+          "uniqueItems": true
+        },
+        "properties": {
+          "type": "object",
+          "additionalProperties": true
+        },
+        "provenance": { "$ref": "#/$defs/provenance" }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": { "type": { "const": "Evidence" } },
+            "required": ["type"]
+          },
+          "then": {
+            "properties": {
+              "interfaces": {
+                "contains": { "const": "ContentAddressed" }
+              },
+              "properties": {
+                "required": ["path"],
+                "properties": {
+                  "path": { "type": "string", "minLength": 1 }
+                }
+              },
+              "provenance": {
+                "required": ["contentHash"]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": { "type": { "const": "ImplementationUnit" } },
+            "required": ["type"]
+          },
+          "then": {
+            "properties": {
+              "interfaces": {
+                "contains": { "const": "ContentAddressed" }
+              },
+              "properties": {
+                "required": ["path"],
+                "properties": {
+                  "path": { "type": "string", "minLength": 1 }
+                }
+              },
+              "provenance": {
+                "required": ["contentHash"]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": { "type": { "const": "Validation" } },
+            "required": ["type"]
+          },
+          "then": {
+            "properties": {
+              "properties": {
+                "required": ["status", "executedAt", "inputs"],
+                "properties": {
+                  "status": { "enum": ["PASS", "FAIL", "BLOCKED"] },
+                  "executedAt": { "type": "string", "format": "date-time" },
+                  "inputs": {
+                    "type": "array",
+                    "items": { "$ref": "#/$defs/validationInput" }
+                  }
+                }
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": { "type": { "const": "Candidate" } },
+            "required": ["type"]
+          },
+          "then": {
+            "properties": {
+              "interfaces": {
+                "contains": { "const": "ContentAddressed" }
+              },
+              "properties": {
+                "required": ["ref"],
+                "properties": {
+                  "ref": { "type": "string", "minLength": 1 }
+                }
+              },
+              "provenance": {
+                "required": ["contentHash"]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": { "type": { "const": "GateRun" } },
+            "required": ["type"]
+          },
+          "then": {
+            "properties": {
+              "properties": {
+                "required": ["status", "executedAt"],
+                "properties": {
+                  "status": { "enum": ["PASS", "FAIL", "BLOCKED", "SKIPPED"] },
+                  "executedAt": { "type": "string", "format": "date-time" }
+                }
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "type": {
+                "enum": ["Claim", "Challenge", "Counterexample", "Waiver", "Policy"]
+              }
+            },
+            "required": ["type"]
+          },
+          "then": {
+            "properties": {
+              "properties": {
+                "required": ["statement"],
+                "properties": {
+                  "statement": { "type": "string", "minLength": 1 }
+                }
+              }
+            }
+          }
+        }
+      ],
+      "additionalProperties": false
+    },
+    "validationInput": {
+      "type": "object",
+      "required": ["objectId", "contentHash"],
+      "properties": {
+        "objectId": { "$ref": "#/$defs/stableId" },
+        "contentHash": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        }
+      },
+      "additionalProperties": false
+    },
+    "link": {
+      "type": "object",
+      "required": ["id", "type", "from", "to", "lifecycle", "provenance"],
+      "properties": {
+        "id": { "$ref": "#/$defs/stableId" },
+        "type": {
+          "enum": [
+            "CONTAINS",
+            "PROPOSES",
+            "DERIVED_FROM",
+            "REFINES",
+            "IMPLEMENTED_BY",
+            "VERIFIED_BY",
+            "VIOLATES",
+            "RESOLVES",
+            "PRODUCES",
+            "SUPPORTS",
+            "CONTRADICTS",
+            "REMAINS_AFTER",
+            "EVALUATES",
+            "DECIDES",
+            "ASSERTS",
+            "CHALLENGES",
+            "REFUTES",
+            "SUPPORTED_BY",
+            "WAIVES",
+            "GOVERNS",
+            "SUPERSEDES"
+          ]
+        },
+        "from": { "$ref": "#/$defs/stableId" },
+        "to": { "$ref": "#/$defs/stableId" },
+        "lifecycle": { "$ref": "#/$defs/lifecycle" },
+        "provenance": { "$ref": "#/$defs/provenance" }
+      },
+      "additionalProperties": false
+    },
+    "invariantResult": {
+      "type": "object",
+      "required": ["id", "status", "severity", "message", "objectIds"],
+      "properties": {
+        "id": { "type": "string", "minLength": 1 },
+        "status": { "enum": ["PASS", "FAIL", "NOT_APPLICABLE"] },
+        "severity": { "enum": ["info", "warning", "blocking"] },
+        "message": { "type": "string" },
+        "objectIds": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/stableId" },
+          "uniqueItems": true
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/project-profile.schema.json

@@ -10,6 +10,24 @@
     "projectRoot": { "type": "string" },
     "projectTypes": { "type": "array", "items": { "type": "string" } },
     "adapters": { "type": "array", "items": { "type": "string" } },
+    "bddSources": { "type": "array", "items": { "type": "string" } },
+    "availableBddSources": { "type": "array", "items": { "type": "string" } },
+    "repositoryLayout": {
+      "type": "object",
+      "properties": {
+        "manifests": { "type": "array", "items": { "type": "string" } },
+        "moduleRoots": { "type": "array", "items": { "type": "string" } },
+        "discovery": { "type": "string" }
+      }
+    },
+    "consistencyScope": {
+      "type": "object",
+      "properties": {
+        "authorityRoots": { "type": "array", "items": { "type": "string" } },
+        "relationStrategies": { "type": "array", "items": { "type": "string" } },
+        "semanticCrossSpecSearchRequired": { "type": "boolean" }
+      }
+    },
     "designEntry": {
       "type": "object",
       "required": ["type", "changeId", "lifecycle", "changeRoot", "documents", "deltaSpecs", "baselineSpecs"],
@@ -38,6 +56,32 @@
     },
     "deltaSpecs": { "type": "array", "items": { "type": "string" } },
     "baselineSpecs": { "type": "array", "items": { "type": "string" } },
+    "relatedBaselineSpecs": { "type": "array", "items": { "type": "string" } },
+    "relatedBaselineReasons": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "array",
+        "items": { "type": "string" }
+      }
+    },
+    "semanticConsistencyCandidates": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["spec", "score", "sharedSymbols", "reason"],
+        "properties": {
+          "spec": { "type": "string" },
+          "score": { "type": "number", "minimum": 0 },
+          "sharedSymbols": {
+            "type": "array",
+            "items": { "type": "string" },
+            "minItems": 2
+          },
+          "reason": { "const": "shared-normative-symbols" }
+        },
+        "additionalProperties": false
+      }
+    },
     "designSources": { "type": "array", "items": { "type": "string" } },
     "implementationRoots": { "type": "array", "items": { "type": "string" } },
     "testRoots": { "type": "array", "items": { "type": "string" } },

package/skills/knowledge-bdd/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: knowledge-bdd
-version: 1.1.2
-description: Derive Given-When-Then acceptance scenarios from confirmed design rules and flow contracts.
+description: Interpret or derive Gherkin/BDD Feature, Background, Scenario, Scenario Outline, Examples, and Given-When-Then acceptance contracts when .feature files or confirmed behavioral rules are in scope.
+metadata:
+  version: 1.1.4
 ---
 
 # Knowledge: BDD
@@ -20,3 +21,14 @@ For every confirmed rule, consider:
 - concurrency or ordering
 
 BDD scenarios are acceptance criteria. They are not a license to invent behavior outside source truth.
+
+When `.feature` files are mounted in the ontology:
+
+- treat `Feature` as the parent Requirement
+- preserve inherited Background clauses
+- preserve Scenario Outline Examples without expanding invented cases
+- use `DERIVED_FROM` and `REFINES` for source and parent traceability
+- add `VERIFIED_BY` only after current executable validation produces evidence
+
+Use `ontology-explain --id <scenario-id>` when a scenario's source, parent,
+implementation, validation, or evidence chain is unclear.

package/skills/knowledge-change-impact/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: knowledge-change-impact
+description: Trace a design, code, test, policy, or evidence change through project-profile roots and ontology relations to determine affected obligations, implementation units, validations, gates, and decisions. Use before planning work, after drift, and after repairs to invalidate and rerun only the evidence that is no longer current.
+metadata:
+  version: 1.1.4
+---
+
+# Change Impact
+
+Build a bounded, evidence-backed impact set. Do not equate filename proximity
+with semantic dependency.
+
+## Workflow
+
+1. Identify changed artifacts and their current hashes.
+2. Read `reports/project-profile.json` for module, implementation, test, design,
+   and authority roots.
+3. Use ontology `ontology-drift`, `ontology-query --query impact`, and
+   `ontology-plan` when a current snapshot exists.
+4. Traverse from changed sources or implementation units through obligations,
+   scenarios, validations, evidence, risks, and decisions.
+5. Add repository dependencies supported by imports, public contracts, build
+   manifests, design maps, or explicit references.
+6. Mark dependent gate decisions `STALE` from the earliest affected boundary.
+7. Produce the minimal safe rerun plan and name excluded gates with evidence.
+
+## Boundaries
+
+- A Spec or acceptance change invalidates downstream design, implementation,
+  test, consistency, CI, and admission evidence.
+- An architecture or interface change invalidates affected ownership and
+  integration evidence.
+- An implementation change invalidates affected code, developer-test,
+  consistency, CI, and admission evidence.
+- A test, fixture, pipeline, policy, or candidate change invalidates only the
+  decisions that consumed it, unless authority evidence shows wider impact.
+- Unknown dependency direction is blocking when it could hide a required gate.
+
+## Output
+
+Record changed roots, impacted object IDs and paths, invalidated decisions,
+required reruns, unaffected decisions with justification, and residual
+unknowns. Keep facts, inferences, and assumptions distinct.

package/skills/knowledge-change-impact/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Change Impact"
+  short_description: "Trace semantic change impact and invalidated evidence"
+  default_prompt: "Use $knowledge-change-impact to trace this change through obligations, implementation, validation, and gates."

package/skills/knowledge-openspec/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: knowledge-openspec
-version: 1.1.2
 description: OpenSpec knowledge pack for proposals, specs, scenarios, tasks, changes, archived capabilities, validation, and design-to-implementation mapping.
+metadata:
+  version: 1.1.4
 ---
 
 # Knowledge: OpenSpec

package/skills/knowledge-repair-distill/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: knowledge-repair-distill
-version: 1.1.2
 description: Generic repair convergence guidance, gap taxonomy, model steering hints, and validation gates for design-implementation consistency work.
+metadata:
+  version: 1.1.4
 ---
 
 # Knowledge: Repair Distill

package/skills/quality-adversarial-challenge/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: quality-adversarial-challenge
+description: Stress-test high-risk design, implementation, validation, and admission claims by constructing falsifiable challenges and reproducible counterexamples. Use after ordinary review when the project profile exposes high blast radius, security or lifecycle risk, cross-Spec ambiguity, weak negative-path coverage, or a high-confidence PASS claim that needs independent challenge.
+metadata:
+  version: 1.1.4
+---
+
+# Adversarial Challenge
+
+Challenge claims, not people. Remain read-only.
+
+## Workflow
+
+1. Read the frozen `Candidate`, applicable `Policy`, current `GateRun`, and its
+   evidence-backed `Claim` objects.
+2. Select only high-value attack surfaces from the project profile, impact
+   analysis, semantic conflicts, changed boundaries, and residual risks.
+3. State each challenge as a falsifiable condition: claim, attack premise,
+   minimal experiment, expected observation, and disconfirming observation.
+4. Prefer boundary values, invalid sequences, stale state, concurrency,
+   partial failure, rollback, authority conflicts, and evidence/candidate hash
+   mismatches.
+5. Reproduce a successful attack with exact inputs, commands, environment,
+   observed output, and candidate identity.
+6. Record a `Challenge` linked by `CHALLENGES`. Record a reproducible
+   `Counterexample` linked by `REFUTES`; never manufacture a counterexample
+   from speculation.
+7. Mark a challenge resolved only after current evidence addresses the same
+   premise on the same candidate.
+
+## Selection rule
+
+Do not launch a fixed adversarial team. Choose the smallest independent
+challenge set that covers materially different failure hypotheses. Stop when
+additional challenges repeat an already covered premise or have no plausible
+impact on a gate decision.
+
+## Output
+
+Produce a challenge ledger with IDs, target claims, premises, experiments,
+results, evidence, and lifecycle. Any unresolved material challenge blocks
+`PASS`; absence of a found counterexample is not proof of correctness.

package/skills/quality-adversarial-challenge/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Adversarial Challenge"
+  short_description: "Challenge high-risk consistency claims with counterexamples"
+  default_prompt: "Stress-test the candidate consistency claims and record reproducible challenges."

package/skills/quality-ci-gate/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: quality-ci-gate
+description: Plan and verify candidate-bound continuous-integration gates for risk coverage, reliability, runtime cost, flake control, and traceable evidence. Use in PLAN phase before implementation and VERIFY phase before commit, merge, or release; repeat when the change surface, candidate, tests, pipeline, or gate policy changes.
+metadata:
+  version: 1.1.4
+---
+
+# Quality CI Gate
+
+Maximize defect-detection value per unit of developer delay without weakening critical controls.
+
+Bind both PLAN and VERIFY decisions to the current Harness gate and candidate.
+Preserve the decision as durable evidence, then record `delivery.plan` or
+`delivery.verify` with `qiheng harness-record`. Refuse to record after candidate
+or project-profile drift.
+
+## Workflow
+
+1. Declare `phase: PLAN` or `phase: VERIFY`, candidate identity, and the change
+   surface. Never mix the two phases in one decision.
+2. Read `references/ci-gate.md`.
+3. In `PLAN`, inventory each required gate, defect class, trigger, owner,
+   runtime budget, evidence, and failure policy.
+4. In `VERIFY`, consume the exact current plan and verify that every mandatory
+   result belongs to the frozen candidate.
+5. Find missing controls, redundant gates, false confidence, flakes, and serial
+   bottlenecks.
+6. Define quarantine, retry, override, and restoration rules without turning
+   critical failures green.
+7. Mark verification stale when candidate bytes, tests, fixtures, pipeline, or
+   gate policy changes.
+
+## Profile-driven rules
+
+Preserve mandatory gates discovered from repository policy, project-profile
+validation commands, module manifests, and affected frontend/backend roots.
+Do not substitute a root command for an affected module-specific gate unless
+repository evidence proves equivalence.
+
+## Output
+
+Use `PASS`, `PASS WITH FOLLOW-UP`, or `BLOCKED`. Include phase, plan ID and hash,
+candidate identity, gate matrix, current result links, critical gaps, redundant
+or low-value gates, runtime budget, flake policy, evidence retention, pipeline
+stages, and expected quality and lead-time effects.

package/skills/quality-ci-gate/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Quality CI Gate"
+  short_description: "Plan or verify candidate-bound CI quality gates"
+  default_prompt: "Use $quality-ci-gate in PLAN or VERIFY phase to assess current candidate gates, evidence, reliability, and delivery efficiency."

package/skills/quality-ci-gate/references/ci-gate.md

@@ -0,0 +1,22 @@
+# CI gate effectiveness
+
+For every gate record:
+
+- defect/risk class and governing requirement;
+- trigger and pipeline stage;
+- exact command and environment;
+- owner and escalation path;
+- median/P95 runtime and queue impact;
+- pass rate, false-positive rate, flake rate, and retry behavior;
+- produced evidence, retention, provenance, and candidate binding;
+- fail-open/closed policy, override authority, and removal criteria.
+
+Prefer:
+
+- change-aware fast checks before merge;
+- parallel independent checks;
+- deterministic cache keys and fail-safe cache misses;
+- expensive exhaustive checks at release or scheduled stages only when admission risk remains covered;
+- explicit time budgets and a measured feedback loop.
+
+Never optimize lead time by dropping security, contract, isolation, data-integrity, or release-critical evidence. Remove redundant gates only after proving equivalent coverage.

package/skills/quality-code-review/SKILL.md

@@ -0,0 +1,32 @@
+---
+name: quality-code-review
+description: Perform candidate-bound semantic code review covering specification alignment, architecture, security, performance, reliability, observability, and maintainability. Use whenever implementation risk becomes applicable during development, DIC repair, pre-commit, pull request, or targeted audit; re-run when affected code or governing contracts change.
+metadata:
+  version: 1.1.4
+---
+
+# Quality Code Review
+
+Review observable risk and contract impact, not style preference.
+
+## Workflow
+
+1. Fix the candidate and diff baseline and read governing specs, repository instructions, and affected public contracts.
+2. Read `references/code-review.md`.
+3. Inspect call paths and ownership beyond changed lines only where needed to prove impact.
+4. Run the smallest relevant build, tests, architecture checks, and security/performance probes.
+5. Separate confirmed defects from risks requiring measurement.
+6. Bind the decision to candidate and governing-source hashes. Mark it stale
+   after an affected implementation or contract change.
+7. Report findings first. Do not edit unless the user requests remediation.
+
+## Profile-driven rules
+
+Load repository-local code-review policy when the project profile or repository
+instructions identify it. Derive affected module, interface, security,
+persistence, frontend, runtime, and validation boundaries from repository
+evidence rather than a named project template.
+
+## Output
+
+Use P0-P3 and `PASS`, `PASS WITH FOLLOW-UP`, or `BLOCKED`. Every finding needs a tight location, failure scenario, evidence, impact, and required fix. State commands run, exact results, untested areas, and residual risk.

package/skills/quality-code-review/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Quality Code Review"
+  short_description: "Review code architecture, security, performance, and clarity"
+  default_prompt: "Use $quality-code-review to review this candidate change for contract alignment, architecture, security, reliability, and performance."

package/skills/quality-code-review/references/code-review.md

@@ -0,0 +1,13 @@
+# Semantic code review coverage
+
+Review:
+
+- spec and acceptance alignment; no undocumented public behavior;
+- dependency direction, ownership, public boundaries, cohesion, coupling, and duplicate policy;
+- clear naming, small cohesive units, explicit errors, minimal abstraction, removed task-created dead code, and tests focused on behavior;
+- input validation, identity/trust source, authorization, injection, secrets, sensitive output, unsafe execution, dependency risk, and denial-of-service;
+- algorithmic complexity, allocation, I/O, query shape, batching, backpressure, caching correctness, concurrency, and measurable budgets;
+- timeout, cancellation, retry, idempotency, atomicity, recovery, compatibility, observability, redaction, and diagnostics;
+- product-path use of new code and negative tests for forbidden paths.
+
+Do not claim a performance defect from aesthetics alone. Provide a complexity argument, workload bound, query plan, benchmark, profile, or clearly labelled risk requiring measurement.