mustflow 2.107.3 → 2.108.0

package/dist/core/change-verification.js

@@ -324,6 +324,13 @@ function gapForRequirement(requirement, candidates) {
         detail: `No runnable command intents cover required_after = "${requirement.reason}".`,
     };
 }
+/**
+ * mf:anchor core.verification.change-report
+ * purpose: Turn changed-file classification into verification requirements, candidates, gaps, and a scheduled intent plan.
+ * search: verification report, required_after, selected intents, gaps, test selection
+ * invariant: Selected verification intents must come from configured command-contract coverage and declared test selection.
+ * risk: config, data_consistency
+ */
 export function createChangeVerificationReport(classificationReport, commandContract, projectRoot) {
     const testSelectionPlan = createProjectTestSelectionPlan(projectRoot, classificationReport, commandContract);
     const requirements = classificationReport.summary.validationReasons.map((reason) => createVerificationRequirement(classificationReport, reason));

package/dist/core/verification-scheduler.js

@@ -137,6 +137,13 @@ function addEntryToBatches(batches, batchEntries, entry) {
         locks: entry.locks,
     });
 }
+/**
+ * mf:anchor core.verification.schedule-locks
+ * purpose: Order selected verification intents by command-effect locks and undeclared-write risk.
+ * search: verification schedule, command effects, locks, parallel eligible, undeclared writes
+ * invariant: Intents without explicit compatible effects or with recent undeclared writes stay serial-only.
+ * risk: config, state
+ */
 export function createVerificationSchedule(projectRoot, commandContract, candidates) {
     const latestUndeclaredWriteIntents = readLatestUndeclaredWriteIntents(projectRoot);
     const runnableIntents = uniqueSorted(candidates

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mustflow",
-  "version": "2.107.3",
+  "version": "2.108.0",
   "description": "Agent workflow documents and CLI for mustflow repository roots.",
   "type": "module",
   "license": "MIT-0",

package/schemas/README.md

@@ -39,9 +39,9 @@ Current schemas:
 - `evidence-report.schema.json`: output of `mf evidence --changed --json`, containing verification
   requirements, risk-priced evidence assessment, latest bounded evidence, failure replay capsules,
   conflict ledgers, receipts, remaining risks, and gaps without running commands
-- `workspace-status.schema.json`: output of `mf workspace status --json`, containing configured
-  workspace roots, discovered nested repositories, and per-root command-contract readiness without
-  granting command authority
+- `workspace-status.schema.json`: output of `mf workspace status --json` and
+  `mf workspace scan --json`, containing configured or ad hoc workspace roots, discovered nested
+  repositories, and per-root command-contract readiness without granting command authority
 - `workspace-command-catalog.schema.json`: output of `mf workspace command-catalog --json`,
   containing per-root command intent availability, safe `mf run` entrypoints, and no raw command
   strings

package/schemas/workspace-status.schema.json

@@ -16,7 +16,7 @@
   ],
   "properties": {
     "schema_version": { "const": "1" },
-    "command": { "const": "workspace status" },
+    "command": { "enum": ["workspace status", "workspace scan"] },
     "mustflow_root": { "type": "string" },
     "workspace": {
       "type": "object",
@@ -65,7 +65,9 @@
       "type": "array",
       "items": { "$ref": "#/$defs/repository" }
     },
-    "issues": { "$ref": "#/$defs/stringArray" }
+    "issues": { "$ref": "#/$defs/stringArray" },
+    "projects_dir": { "type": "string" },
+    "next_actions": { "$ref": "#/$defs/stringArray" }
   },
   "$defs": {
     "stringArray": {

package/templates/default/common/.mustflow/config/mustflow.toml

@@ -34,7 +34,7 @@ project_context = ".mustflow/context/PROJECT.md"
 output = "REPO_MAP.md"
 mode = "anchors_only"
 privacy = "minimal"
-include_nested = false
+include_nested = true
 anchor_files = [
   "AGENTS.md",
   "REPO_MAP.md",
@@ -94,8 +94,8 @@ anchor_files = [
 ]
 
 [workspace]
-enabled = false
-roots = []
+enabled = true
+roots = ["projects"]
 max_depth = 4
 max_repositories = 50
 follow_symlinks = false

package/templates/default/i18n.toml

@@ -40,7 +40,7 @@ translations.hi = { path = "locales/hi/.mustflow/context/PROJECT.md", source_rev
 [documents."docs.agent-workflow"]
 source = "locales/en/.mustflow/docs/agent-workflow.md"
 source_locale = "en"
-revision = 27
+revision = 28
 translations.ko = { path = "locales/ko/.mustflow/docs/agent-workflow.md", source_revision = 23, status = "needs_review" }
 translations.zh = { path = "locales/zh/.mustflow/docs/agent-workflow.md", source_revision = 18, status = "needs_review" }
 translations.es = { path = "locales/es/.mustflow/docs/agent-workflow.md", source_revision = 18, status = "needs_review" }
@@ -62,7 +62,7 @@ translations = {}
 [documents."skills.index"]
 source = "locales/en/.mustflow/skills/INDEX.md"
 source_locale = "en"
-revision = 200
+revision = 206
 translations = {}
 
 [documents."skill.adapter-boundary"]
@@ -152,7 +152,7 @@ translations = {}
 [documents."skill.payment-integrity-review"]
 source = "locales/en/.mustflow/skills/payment-integrity-review/SKILL.md"
 source_locale = "en"
-revision = 3
+revision = 4
 translations = {}
 
 [documents."skill.credit-ledger-integrity-review"]
@@ -161,12 +161,36 @@ source_locale = "en"
 revision = 1
 translations = {}
 
+[documents."skill.notification-delivery-integrity-review"]
+source = "locales/en/.mustflow/skills/notification-delivery-integrity-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.admin-control-plane-safety-review"]
+source = "locales/en/.mustflow/skills/admin-control-plane-safety-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.small-service-platform-architecture-review"]
+source = "locales/en/.mustflow/skills/small-service-platform-architecture-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
 [documents."skill.api-misuse-resistance-review"]
 source = "locales/en/.mustflow/skills/api-misuse-resistance-review/SKILL.md"
 source_locale = "en"
 revision = 1
 translations = {}
 
+[documents."skill.third-party-api-integration-review"]
+source = "locales/en/.mustflow/skills/third-party-api-integration-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
 [documents."skill.api-access-control-review"]
 source = "locales/en/.mustflow/skills/api-access-control-review/SKILL.md"
 source_locale = "en"
@@ -317,9 +341,21 @@ source_locale = "en"
 revision = 1
 translations = {}
 
+[documents."skill.frontend-component-library-review"]
+source = "locales/en/.mustflow/skills/frontend-component-library-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
 [documents."skill.frontend-localization-review"]
 source = "locales/en/.mustflow/skills/frontend-localization-review/SKILL.md"
 source_locale = "en"
+revision = 2
+translations = {}
+
+[documents."skill.website-task-friction-review"]
+source = "locales/en/.mustflow/skills/website-task-friction-review/SKILL.md"
+source_locale = "en"
 revision = 1
 translations = {}
 
@@ -386,7 +422,7 @@ translations = {}
 [documents."skill.deployment-rollout-safety-review"]
 source = "locales/en/.mustflow/skills/deployment-rollout-safety-review/SKILL.md"
 source_locale = "en"
-revision = 2
+revision = 3
 translations = {}
 
 [documents."skill.cloud-cost-guardrail-review"]
@@ -452,13 +488,13 @@ translations = {}
 [documents."skill.database-change-safety"]
 source = "locales/en/.mustflow/skills/database-change-safety/SKILL.md"
 source_locale = "en"
-revision = 16
+revision = 17
 translations = {}
 
 [documents."skill.database-migration-change"]
 source = "locales/en/.mustflow/skills/database-migration-change/SKILL.md"
 source_locale = "en"
-revision = 3
+revision = 4
 translations = {}
 
 [documents."skill.database-query-bottleneck-review"]
@@ -607,7 +643,7 @@ translations = {}
 [documents."skill.auth-permission-change"]
 source = "locales/en/.mustflow/skills/auth-permission-change/SKILL.md"
 source_locale = "en"
-revision = 3
+revision = 4
 translations = {}
 
 [documents."skill.security-flow-review"]
@@ -814,6 +850,12 @@ source_locale = "en"
 revision = 2
 translations = {}
 
+[documents."skill.cli-option-contract-review"]
+source = "locales/en/.mustflow/skills/cli-option-contract-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
 [documents."skill.cli-output-contract-review"]
 source = "locales/en/.mustflow/skills/cli-output-contract-review/SKILL.md"
 source_locale = "en"
@@ -1149,6 +1191,12 @@ source_locale = "en"
 revision = 2
 translations = {}
 
+[documents."skill.ai-product-readiness-review"]
+source = "locales/en/.mustflow/skills/ai-product-readiness-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
 [documents."skill.prompt-contract-quality-review"]
 source = "locales/en/.mustflow/skills/prompt-contract-quality-review/SKILL.md"
 source_locale = "en"
@@ -1179,6 +1227,12 @@ source_locale = "en"
 revision = 1
 translations = {}
 
+[documents."skill.browser-automation-reliability-review"]
+source = "locales/en/.mustflow/skills/browser-automation-reliability-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
 [documents."skill.agent-eval-integrity-review"]
 source = "locales/en/.mustflow/skills/agent-eval-integrity-review/SKILL.md"
 source_locale = "en"

package/templates/default/locales/en/.mustflow/docs/agent-workflow.md

@@ -2,7 +2,7 @@
 mustflow_doc: docs.agent-workflow
 locale: en
 canonical: true
-revision: 27
+revision: 28
 lifecycle: mustflow-owned
 authority: workflow-policy
 ---
@@ -68,6 +68,29 @@ When multiple skills apply, follow the most specific skill for each affected sco
 
 When a skill is used, report the skill name and selection reason briefly in the next user-facing update or final report. When files were created or modified, the final report must include a concise skill-selection note: list the skills used, say that no matching installed skill was found, or report that a plausible skill is missing from the installed profile. Do not create a versioned worklog solely to record skill selection.
 
+### Script-Pack Selection
+
+Script-pack suggestions are optional evidence helpers, not skill procedures or command authority.
+Skills remain the primary procedure owner: select and read the matching `SKILL.md` first, then use
+script-pack metadata only to decide whether a bounded helper would improve orientation,
+synchronization, or review evidence.
+
+When the command contract exposes `script_pack_list`, use it for catalog discovery only. When the
+command contract exposes `script_pack_suggest_changed`, use it after changed files exist to get
+optional helper suggestions from current path evidence. These discovery commands do not run helper
+scripts, authorize new commands, or replace the skill-selection gate.
+
+Prefer helper candidates whose `related_skills` include the selected skill, whose `phases` match the
+current phase (`before_change`, `during_change`, `after_change`, or `review`), and whose `use_when`
+matches the changed paths and risk. Discard a candidate when `read_only` is false, `mutates` is true,
+network, destructive, interactive, or long-running behavior appears, required inputs are unavailable,
+the phase does not match, or no configured oneshot command intent authorizes that exact action.
+
+Script-pack output can focus what to inspect, but it does not replace reading `SKILL.md`, relevant
+source files, configured verification intents, documentation review requirements, or final completion
+evidence. Suggested helpers are not mandatory. Report skipped useful suggestions only when they were
+relevant to the current risk but not run.
+
 ## Input Stability
 
 Treat user instructions, local files, command contracts, and generated reports as distinct sources. Avoid conflating these sources.