hstack 0.1.0

package/template/templates/threat-model.md

@@ -0,0 +1,54 @@
+---
+id: threat-model
+type: threat-model
+status: drafted                        # drafted | current | needs-refresh | archived
+owner: <git-handle>
+last-quarterly-review: <YYYY-MM-DD>
+surfaces-covered: [ui, api, db, infra, agent]
+created: <YYYY-MM-DD>
+updated: <YYYY-MM-DD>
+schema-version: 1
+---
+
+_One section per surface in `surfaces-covered` (validator rule TM-01). Each section enumerates concrete threats with: threat description, affected assets, mitigation, mitigation evidence (pointer to code, ADR, or hardening-checklist item). Length cap: 8 threats per surface._
+
+## ui
+
+### Threat: <name>
+**Affected assets.**
+**Mitigation.**
+**Evidence.**
+
+## api
+
+### Threat: <name>
+**Affected assets.**
+**Mitigation.**
+**Evidence.**
+
+## db
+
+### Threat: <name>
+**Affected assets.**
+**Mitigation.**
+**Evidence.**
+
+## infra
+
+### Threat: <name>
+**Affected assets.**
+**Mitigation.**
+**Evidence.**
+
+## agent
+
+### Threat: <name>
+**Affected assets.**
+**Mitigation.**
+**Evidence.**
+
+## Unknowns
+
+_Challenge prompt: what threat to our multi-tenant boundary do you not yet have a mitigation for? This section must be present even when empty, to make the absence explicit (validator rule TM-02)._
+
+-

package/template/templates/ui-brief.md

@@ -0,0 +1,49 @@
+---
+id: <parent-change-id>-ui-brief
+type: ui-brief
+status: draft                          # draft | drafted | superseded
+owner: <git-handle>
+parent-change: <change-spec-id>
+reused-components: []                  # design-system component ids
+new-components: []                     # any non-empty entry requires a justification subsection
+design-system-version: <version>       # must match hstack/config.yaml
+created: <YYYY-MM-DD>
+updated: <YYYY-MM-DD>
+schema-version: 1
+---
+
+## Goal
+
+_One paragraph. What the UI must achieve from the user's POV._
+
+## Layouts and States
+
+_For every visible state of every new or modified surface: layout, content, interaction. Paragraph or bullets per state._
+
+## Reused Components
+
+_Bullets pointing to existing components by design-system id._
+
+-
+
+## New Components
+
+_For each: name, props, justification for not reusing. Challenge prompt: why is this new and not a reuse?_
+
+### <ComponentName>
+
+**Props.** `{ ... }`
+
+**Justification.**
+
+## Copy
+
+_Exact strings the user sees. Reviewed by cofounder. Bullets._
+
+-
+
+## Accessibility Notes
+
+_Anything that requires non-default handling (focus order, screen reader copy, contrast deviation). Bullets._
+
+-

package/template/templates/verification.md

@@ -0,0 +1,63 @@
+---
+id: <parent-change-id>-verification
+type: verification
+status: draft                          # draft | ran | passed | failed | superseded
+owner: <git-handle>
+parent-change: <change-spec-id>
+test-results:
+  unit: pending                        # pass | fail | pending | not-run
+  integration: pending
+  e2e: pending
+  lint: pending
+  typecheck: pending
+phase-coverage: {}                     # mirror of plan.steps-completed; { <phase-id>: pass | fail }
+test-plan-coverage:                    # observed-vs-promised against test-plan.md
+  edge-cases: pending                  # all-observed | partial | missing
+  tenant-isolation: pending            # all-observed | partial | missing | not-applicable
+  performance-budgets: pending         # all-within-budget | regressed | missing | not-applicable
+artifacts:
+  test-output: <path>
+created: <YYYY-MM-DD>
+updated: <YYYY-MM-DD>
+schema-version: 1
+---
+
+## Summary
+
+_Single-sentence verdict._
+
+## Per-Phase Outcomes
+
+_Table of phase id, verifier expectations met (yes/no), notes. Three columns max._
+
+| phase-id | met | notes |
+| --- | --- | --- |
+|  |  |  |
+
+## Test-Plan Coverage
+
+_Observed-vs-promised against `test-plan.md`. Three subsections; populate only those that apply to this change._
+
+### Edge Cases
+
+_Every bullet in the test-plan's Edge Cases section maps to an observed test. Absent or skipped tests are listed with a recommended action._
+
+### Tenant Isolation
+
+_Every entry in the test-plan's `tenant-isolation-tests` array maps to an observed negative test. Absences here are high-severity and escalate to adversarial-review (V-03)._
+
+### Performance Budgets
+
+_Every row in the test-plan's Budgets table maps to an observed assertion within budget. Regressions and absences block `status: passed` (V-04)._
+
+| path | budget | observed | within budget |
+| --- | --- | --- | --- |
+|  |  |  |  |
+
+## Test Suite Output
+
+_Pointer to the captured stdout/stderr blob (`artifacts.test-output`)._
+
+## Discrepancies
+
+_Anything the verifier observed that the plan did not predict, with an action (file an issue, escalate to adversarial-review)._

package/template/templates/vision.md

@@ -0,0 +1,34 @@
+---
+id: vision
+type: vision
+status: drafted                        # drafted | current | needs-refresh | archived
+owner: <git-handle>
+reviewed-quarterly-on: <YYYY-MM-DD>
+created: <YYYY-MM-DD>
+updated: <YYYY-MM-DD>
+schema-version: 1
+---
+
+## What this product is
+
+_Two or three sentences naming the product and category._
+
+## What it does
+
+_Top 3–5 user-visible capabilities. Bullets._
+
+-
+
+## What it explicitly is not
+
+_Boundaries we are committing not to cross. Bullets._
+
+-
+
+## Who it is for
+
+_Pointer to personas. Not a duplication of persona content._
+
+## Why now
+
+_The timing thesis. Two or three sentences._