musubix3 0.1.0

package/.github/plugin/marketplace.json

@@ -0,0 +1,16 @@
+{
+  "name": "musubix3-marketplace",
+  "owner": { "name": "nahisaho" },
+  "metadata": {
+    "description": "GitHub Copilot CLI specification-driven development skills",
+    "version": "0.1.0"
+  },
+  "plugins": [
+    {
+      "name": "musubix3",
+      "source": ".",
+      "version": "0.1.0",
+      "description": "Evidence-driven SDD without duplicating native Copilot capabilities."
+    }
+  ]
+}

package/.github/skills/sdd-change/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: sdd-change
+description: "Use for feature additions, behavior changes, bug fixes, refactoring with observable impact, or any request that must propagate through requirements, design, code, tests, traceability, and quality evidence. 機能追加・仕様変更・バグ修正を一貫して反映するときに使用。"
+---
+# Integrated change workflow / 統合変更ワークフロー
+
+Follow the user's input language (日本語 / English). Use Copilot's native
+planning, editing, research, review, security review and subagents where useful.
+This skill coordinates SDD artifacts and checks; it is not another agent runtime.
+Record exactly one final invocation outcome with `npx musubix3 workflow-record
+sdd-change complete --status <status>`; `change-record` separately proves phases.
+Run `workflow-verify <copilot.jsonl>` to bind this declaration to one Skill call.
+For strict evidence, set an expected UUID or pass `--strict --session-id <uuid>`;
+this checks lifecycles; GitHub origin needs strict OIDC with key-bound claims.
+Never record multiple declarations per invocation; use only the configured CLI.
+For a staged change, run `change-record <CHANGE-ID> <phase> --requirement
+<REQ-ID...>` after each phase in this exact order: `impact`, `requirements`,
+`design`, `red`, `implementation`, `green`, `quality`.
+List only requirements whose statement or acceptance changes, classify each as
+functional/non-functional, and document other impacts separately. Each listed
+requirement needs fresh Red after `requirements` and Green after `implementation`.
+The CHANGE document must contain `Requirements:` with exactly those normative IDs.
+Persisted monotonic order, not wall-clock time, proves these phase boundaries.
+## 1. Classify and inspect / 分類と事前確認
+1. Classify the request as a feature, behavior change, defect correction,
+   refactoring, or documentation-only change.
+2. Read the constitution and relevant requirements, designs, ADRs, code and tests.
+3. Run `npx musubix3 trace impact <id-or-path> --json` and, when code exists,
+   `graph index` plus `graph impact <symbol-or-path> --json`.
+4. Separate confirmed intent, assumptions and open questions. Ask only questions
+   that materially affect observable behavior, safety or compatibility.
+
+## 2. Update specifications first / 仕様を先に更新
+1. For new or changed observable behavior, add or revise EARS requirements and
+   measurable acceptance criteria before implementation. Preserve stable IDs
+   when meaning remains the same; create new IDs when obligations are distinct.
+2. For a bug where implementation violates an existing requirement, keep that
+   requirement and record that no specification change is needed. Never rewrite
+   a requirement merely to make incorrect behavior appear compliant.
+3. Update design responsibilities, interfaces, constraints and requirement links.
+   Add or supersede an ADR only for a real architectural or trade-off decision.
+4. Run requirements, constitution and design validation. Stop on invalid
+   artifacts instead of continuing with unapproved assumptions.
+## 3. Implement and prove coverage / 実装と網羅性
+1. For observable behavior changes and defect fixes, write the smallest meaningful
+   test first. Include its `TEST-*` ID in the test name/output and link it to the
+   requirement with `@verifies`. Configure the command's `tddArgs` with
+   `{testId}` or `{testPath}` so only that test is selected. Configure
+   `tddReport` and make the runner write a fresh `musubix-json` result containing
+   exactly the target test with `failed` or `passed` status, or select a built-in
+   test adapter. For deterministic performance requirements, use a passing
+   instrumented `operations` report with command/report/run/exit provenance;
+   native adapters cannot emit app counters, and elapsed time is insufficient.
+2. Run `npx musubix3 tdd red <TEST-ID> --requirement <REQ-ID> --command <name>`.
+   Do not edit implementation code until this records the expected failing test.
+3. Implement the smallest complete change, preserving the test, then run
+   `tdd green` with the same IDs and command. Refactor only after Green and record
+   `tdd refactor` after the refactored code passes.
+4. Maintain unique `CODE-*` / `TEST-*` IDs and `@implements`, `@design`,
+   `@verifies` annotations in the authoritative implementation and test files.
+   Never create proxy or placeholder source files solely to satisfy trace coverage.
+   Links are evidence locations, not proof by themselves.
+5. Run focused tests during implementation, then the configured typecheck,
+   build and complete test commands.
+Documentation, formatting and prototypes may omit TDD unless policy requires it;
+record the reason and never exempt observable behavior changes.
+## 4. Rebuild evidence and finish / 根拠更新と完了
+1. Run `trace build`, `trace check --strict`, `graph index`, and `graph gate`.
+2. Run `formal check` when changed requirements fit its documented abstraction;
+   use strict `Formal:` JSON for explicit conditional, numeric, temporal or
+   transition semantics; report unsupported prose rather than claiming proof.
+   A required `formal` check enforces modeled fraction and configured solver.
+3. Run `gate --changed --json` and `status --json`. Repair failures, dangling
+   links and stale evidence; never weaken requirements or policy to obtain green.
+4. Complete only when required checks pass and `status.gate.ready` is true.
+   Otherwise report the exact blocker and which artifacts remain incomplete.
+If the user limits the task to one phase, state which downstream work remains;
+never treat an implementation-only change as a complete SDD change.

package/.github/skills/sdd-design/SKILL.md

@@ -0,0 +1,26 @@
+---
+name: sdd-design
+description: "Use when translating approved requirements into explicit components, interfaces, constraints, ADRs, and deterministic architecture diagrams. 設計・ADR・構成図の作成時に使用。"
+---
+# Design / 設計
+
+Follow the user's input language (日本語 / English). Use Copilot's native planning,
+editing, research and review to reason about alternatives; musubix3 validates
+explicit artifacts, not generated prose quality.
+After the work, run `npx musubix3 workflow-record sdd-design complete --status
+completed` exactly once.
+
+1. Read requirements and constitution; identify requirement IDs before designing.
+2. Edit `.musubix/features/<slug>/design.md` with `## DES-FEATURE-001: Title`.
+   Each component needs `Responsibilities:`, `Interfaces:`, `Constraints:`,
+   `Requirements: REQ-FEATURE-001`, and `ADRs: ADR-0001`. Use `Depends-On:` for
+   explicit component dependencies. Fields also accept Japanese labels.
+3. Record real trade-offs under `.musubix/decisions/ADR-xxxx.md`: context, decision,
+   rejected alternatives and consequences. Do not invent existing decisions.
+4. Run `npx musubix3 design validate <file> --json` and
+   `npx musubix3 design c4 <file>`. The Mermaid output reflects only declared
+   components and dependencies; it is C4-like, not a full C4 model.
+5. Run `npx musubix3 trace build` then `npx musubix3 trace check`.
+   Do not hand-edit `trace.json`. Ask native review to inspect coupling and
+   coverage; use `sdd-formal-codegraph` for compiler-based impact checks.
+6. Hand off responsibilities, interfaces, constraints and IDs to implementation.

package/.github/skills/sdd-formal-codegraph/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: sdd-formal-codegraph
+description: "Use for optional formal/neurosymbolic consistency checks, compiler dependency graphs, architecture cycles and conservative code impact analysis. 形式的整合性・コードグラフ・影響分析時に使用。"
+---
+# Formal checks and codegraph / 形式手法・コードグラフ
+
+Follow the user's input language (日本語 / English). Use native Copilot reasoning,
+editing and code navigation to propose and refine artifacts. Deterministic checks
+constrain these proposals; do not create a separate AI/agent runtime.
+After the work, run `npx musubix3 workflow-record sdd-formal-codegraph complete
+--status completed` exactly once.
+
+## Formal consistency / 形式的整合性
+1. Run `npx musubix3 formal generate <requirements-file> --format both --json`
+   to inspect reproducible SMT-LIB2 and Lean artifacts before execution.
+2. Run `npx musubix3 formal doctor --json`, then
+   `npx musubix3 formal check <requirements-file> --solver none --json`.
+   Controlled unconditional English/Japanese obligations enter the Boolean
+   abstraction. Strict optional `Formal:` JSON adds explicit conditional truth,
+   exact integer bounds (`ms`/`s`/`min`, `bytes`/`kib`/`mib`), intersected
+   optional `afterMs`/required `withinMs` response windows, and deterministic
+   state transitions. Other units and incompatible dimensions stay separate.
+3. Inspect `unsupported`, assumptions and diagnostics. Arbitrary prose, domain
+   axioms, scheduling and liveness are not proved. A partial consistency result
+   says nothing about unmodeled requirements or implementation correctness.
+4. Optionally use `--solver auto|z3|lean`. Z3 checks named QF_UFLIA assertions;
+   Lean checks explicit-witness Boolean and translated constraint theorems.
+   Use `--z3-command`, `--lean-command`, or the matching `MUSUBIX3_*`
+   environment variable for nonstandard installations. Missing,
+   unknown, timed-out or failed solvers are explicit, never proof success.
+5. Resolve contradictions with native planning/editing; retain domain judgment.
+6. For explicit `Formal:` JSON, run the full gate and
+   `model-correspondence validate`. The current model and generated trace must
+   reach an authoritative test passed in a fresh structured command report.
+
+## Code impact / コード影響
+1. Run `npx musubix3 graph index` (or `graph index --changed`).
+2. Run `graph impact <symbol-or-path>`, `graph cycles`, and `graph gate --json`.
+   Use `path#symbol` to disambiguate names. Reverse-import paths explain impact.
+3. Rules in config specify source and disallowed target globs; cycles use SCCs.
+   JS/TS imports, re-exports, literal require/dynamic imports, manifest
+   entrypoints and local cache-busting URL/templates with a static base are indexed.
+   Set `codeGraph.mode` to `strict` when unresolved computed `import()` or
+   `require()` calls must block graph gates; the compatible default warns.
+   Conservative native adapters index Rust modules/`use`, Python imports, Go
+   module imports, Java package imports, C/C++ includes, C# namespace imports,
+   PHP namespace/import dependencies, R source/package dependencies and Julia
+   include/module imports, declarations and direct calls. Other languages are
+   reported as unsupported.
+   Statically resolved cache-busting imports remain valid in strict mode.
+   Reflective behavior remains an explicit limitation.
+4. Use native navigation and review to confirm conservative results; rebuild
+   stale caches. No custom LSP/MCP management, generic review or daemon.

package/.github/skills/sdd-implementation/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: sdd-implementation
+description: "Use when implementing approved SDD requirements and designs with explicit code/test trace annotations and real verification evidence. 設計に基づく実装・テスト時に使用。"
+---
+# Implementation / 実装
+
+Follow the user's input language (日本語 / English). Use Copilot's native planning,
+editing and subagents for implementation; do not introduce code generators,
+generic test generators or a second orchestration/task system.
+Run only the repository's exact `musubix3` CLI. Never fall back to similarly
+named npm packages; report a blocker if the executable is unavailable.
+After the work, run `npx musubix3 workflow-record sdd-implementation complete
+--status completed` exactly once.
+
+1. Read the approved requirement/design IDs and constitution. Use native planning
+   for small verifiable changes. Use native subagents only for independent work.
+2. For behavior changes and bug fixes, write a meaningful failing test before
+   implementation. Configure the selected command with `tddArgs` containing
+   `{testId}` or `{testPath}` and a `tddReport`, or use a built-in runner adapter.
+   Follow its native identity contract: pytest/Cargo use underscore names, Go
+   uses a `TEST-*` subtest, and JUnit uses an exact `@Tag("TEST-*")` plus an
+   underscore-form ID in the method name.
+   Make the runner emit a fresh
+   `musubix-json` report containing only the selected test (plus declared
+   deterministic `operations` counters when applicable) and run
+   `npx musubix3 tdd red <TEST-ID> --requirement <REQ-ID> --command <name>`.
+3. Implement only enough code to pass, preserving the test unchanged, then run
+   `tdd green`. Refactor only after Green and record `tdd refactor`.
+4. Add one block comment per trace entity:
+   ```ts
+   /** @id CODE-FEATURE-001
+    * @implements REQ-FEATURE-001
+    * @design DES-FEATURE-001
+    */
+   ```
+   Tests use a separate block:
+   ```ts
+   /** @id TEST-FEATURE-001
+    * @verifies REQ-FEATURE-001
+    */
+   ```
+   IDs are globally unique. Multiple targets are comma/space-separated.
+   Put annotations in the authoritative source and test files, including
+   supported non-JS/TS files; never add a proxy file just to increase coverage.
+   An annotation establishes a link, not proof that code or tests are correct.
+5. Run the project's actual focused tests/typecheck/build; fix failures.
+   When mutation evidence is required, use the project's existing lightweight
+   mutation mechanism to emit schema-v1 deterministic identities, requirement/
+   test linkage, source/test SHA-256, operator/location, and killed status.
+   Never fabricate results or add a large mutation dependency.
+6. Regenerate `npx musubix3 trace build`, check `trace check --strict`, then
+   `npx musubix3 gate --changed`. Configure real command/argument arrays first.
+7. Use Copilot's native review and security-review capabilities when appropriate.
+   Report executed evidence separately from review advice and skipped work.

package/.github/skills/sdd-knowledge/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: sdd-knowledge
+description: "Use when retrieving local SDD decisions, requirements and Git co-change evidence with deterministic ranked search. 仕様・設計判断・Git根拠の検索時に使用。"
+---
+# Knowledge / 知識
+
+Follow the user's input language (日本語 / English). Use Copilot's native memory
+for conversational/project memory and native research for external information.
+This tool indexes local evidence; it is not another memory or research service.
+After the work, run `npx musubix3 workflow-record sdd-knowledge complete --status
+completed` exactly once.
+
+1. Run `npx musubix3 knowledge build`. Markdown artifacts and the last 100 Git
+   commits are indexed locally in `.musubix/cache/knowledge.json`.
+2. Query `npx musubix3 knowledge query "your requirement or decision" --json`.
+   Ranking is deterministic TF-IDF/cosine with Japanese bigram tokenization,
+   not GraphRAG, embeddings, learned expertise or a semantic truth engine.
+3. Read returned source paths before making claims. Scores indicate lexical
+   similarity only. Git co-change is correlation; author-directory counts are
+   contributions, not ownership or expertise assessments.
+4. Rebuild if `stale` is true. Git evidence can be explicitly skipped in an empty
+   repository or when Git is unavailable. Never invent historical evidence.
+5. Use native research only when local sources are insufficient, then native
+   editing to record confirmed decisions as ADRs. Keep cache data local.

package/.github/skills/sdd-quality/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: sdd-quality
+description: "Use when deciding release readiness from actual checks, measurable policy, architecture and trace evidence, including incremental change checks. 品質ゲート・リリース判定時に使用。"
+---
+# Quality / 品質
+
+Follow the user's input language (日本語 / English). Use native Copilot review and
+security review for their specialist reasoning; this skill does not replace them.
+After the work, run `npx musubix3 workflow-record sdd-quality complete --status
+completed` exactly once.
+
+1. Inspect `.musubix/config.json` and `.musubix/policy-baseline.json` before
+   running commands. Only execute trusted project configuration. Commands are
+   executable/argument arrays, not shell text. Never edit the baseline without
+   explicit independent approval. Use only the exact `musubix3` CLI; never
+   substitute similarly named npm packages.
+2. Configure real tests/build/typecheck commands and timeouts. Use an explicit
+   custom report or a built-in Vitest/Jest, pytest, Go test, Cargo or JUnit
+   adapter. Require executable native adapter contracts in CI; JUnit targets use
+   an exact `@Tag("TEST-*")`, and pytest requires `pytest-json-report`. Review
+   `requiredChecks`, coverage thresholds and architecture rules. Use strict
+   `codeGraph.mode` when unresolved computed module loading must block release,
+   and ensure the trusted baseline prevents downgrading it. Configure a
+   fresh structured `testReport` for `test-identities`. Do not weaken policy.
+3. Run `npx musubix3 gate --json` or `npx musubix3 gate --changed --json`.
+   Changed mode reports Git changes and dependent files but conservatively runs
+   all checks, including commands. It never treats unrun checks as successful.
+   When `tdd` is required, confirm every command has test-scoped `tddArgs`, every
+   cycle has a fresh structured `tddReport`, and a real failing Red is followed
+   by a passing Green using the same command and unchanged test.
+4. Inspect `.musubix/evidence/quality.json`: pass/fail/skipped, required flags,
+   command exits/output, measured rules, preserved changed-run context and input
+   fingerprints. Inspect `formal.json` and `workflow.json` when configured.
+   Treat workflow records as declarations until `workflow-verify` binds each
+   completed declaration to one distinct completed Copilot Skill tool call.
+   In strict mode require one final successful result, matching session UUID,
+   causal timestamps, bounded freshness, complete tool lifecycles and canonical
+   transcript hash. Ensure the baseline protects strict/session/freshness policy.
+   When `change-history` is required,
+   confirm ordered checkpoints, chained TDD records, requirement-scoped Code
+   Graph changes, exact CHANGE requirement enumeration, measurable Acceptance,
+   concrete designs, authoritative tests and per-CHANGE artifact completeness.
+   Enforce declared operation counters for deterministic performance budgets;
+   wall-clock duration alone is insufficient. Confirm each observation's hashed
+   gate run, exact command, fresh report, passing test, counter and exit provenance;
+   duplicate sources, persisted stdout report changes and configuration drift
+   invalidate it. Equivalent reruns may change provenance IDs without changing
+   the signed semantic performance head.
+   For explicit `Formal:` JSON, require model-correspondence evidence binding
+   the current model and generated trace to an authoritative `TEST-*` passed by
+   a fresh structured report. For release, set `mutation.mode` to `strict`,
+   protect it and its command in the baseline, and require deterministic mutant
+   identities bound to must functional requirements, current source/test
+   fingerprints, operator/location, authoritative tests, and killed results.
+   Reject survived, skipped, duplicate, conflicting, stale, or unlinked mutants.
+   musubix3 validates evidence; it does not bundle a mutation engine.
+   Missing required tools, commands, artifacts or evidence block readiness.
+5. Use native review/security-review as needed, recording their findings
+   separately from machine evidence. Never fabricate review or test results.
+6. For static CI provenance, configure trusted Ed25519 public keys, freshness
+   bounds and `ci-required`; sign `attestation payload` outside musubix3. For
+   GitHub Actions identity, opt into strict `githubOidc`, derive the key-bound
+   custom audience, obtain a short-lived token, and include only the public key
+   and token in the payload. Verification must fetch issuer metadata/JWKS and
+   check all configured claims; offline strict verification fails closed.
+   Ensure the baseline protects CI-required mode, strict OIDC and key binding.
+   Never store a private key or overstate OIDC as proof of arbitrary runner work.
+7. Run `npx musubix3 status --json`; stale evidence must be refreshed. Report
+   limitations and residual risks before handoff. No resident watcher or REPL.

package/.github/skills/sdd-requirements/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: sdd-requirements
+description: "Use when eliciting, refining, or validating EARS requirements and measurable constitution rules for specification-driven development. 要求定義・EARS検証・憲章策定に使用。"
+---
+# Requirements / 要求
+
+Respond and generate guidance in the user's input language (日本語 / English).
+Use Copilot's native planning, questions, research and editing; do not create an
+interview engine or research agent framework.
+After the work, run `npx musubix3 workflow-record sdd-requirements complete
+--status completed` exactly once.
+
+1. Inspect `.musubix/constitution.md` and the feature's existing requirements.
+   If absent, preview `npx musubix3 init --dry-run` before installing.
+2. Use native planning to clarify scope, stakeholders, measurable acceptance and
+   failure behavior. Separate assumptions from confirmed requirements.
+3. Edit `.musubix/features/<slug>/requirements.md` with headings
+   `## REQ-FEATURE-001: Title`, `Priority: must|should|may`,
+   `Type: functional|non-functional`, and `Statement: ...`. IDs are globally
+   unique. Keep one obligation per entry; add `Acceptance: ...`.
+   Acceptance must be non-placeholder and measurably testable. For semantics
+   that must enter formal coverage, add strict one-line `Formal:` JSON using
+   branch-scoped `conditional`, integer `numeric`, `temporal` with required
+   `withinMs` and optional nonnegative `afterMs`, or deterministic `transition`.
+   For numeric constraints, use compatible duration (`ms`/`s`/`min`) or size
+   (`bytes`/`kib`/`mib`) units when conversion is intended; never translate
+   arbitrary prose or incompatible dimensions by guesswork. A non-functional deterministic
+   budget uses `Performance:` with `counter`, integer `max`, and `testId`.
+4. Use all six controlled EARS forms as appropriate:
+   - The system shall respond.
+   - When an event occurs, the system shall respond.
+   - While a state holds, the system shall respond.
+   - If a fault occurs, then the system shall respond.
+   - Where a feature is enabled, the system shall respond.
+   - While a state holds, when an event occurs, the system shall respond.
+   Japanese equivalents use `システムは…しなければならない。`, with
+   `…とき、` / `…間、` / `もし…ならば、` / `…場合、` clauses.
+5. Validate with `npx musubix3 requirements validate <file> --json` and
+   `npx musubix3 constitution validate --json`. Rules use `PRINC-001`, `RULE-001`,
+   a supported `Metric:` and numeric `Limit:`. Validation is not execution evidence.
+6. Hand off confirmed IDs and unresolved assumptions to `sdd-design`; use native
+   review for semantic completeness, not merely syntactic conformance.

package/.github/skills/sdd-traceability/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: sdd-traceability
+description: "Use when checking requirements-to-design/code/test coverage, dangling IDs, stale trace sources, or bidirectional change impact. 追跡可能性・網羅性・変更影響の確認時に使用。"
+---
+# Traceability / 追跡可能性
+
+Follow the user's input language (日本語 / English). Use Copilot's native code
+navigation, planning and editing to repair missing links; no custom LSP manager.
+After the work, run `npx musubix3 workflow-record sdd-traceability complete
+--status completed` exactly once.
+
+1. Run `npx musubix3 trace build`. It scans `.musubix` artifacts and comment
+   annotations in JS/TS, Rust, Python, Go, Java/Kotlin, C/C++, C#, Ruby, PHP and
+   Swift, then generates feature `trace.json` files plus an ignored cache.
+2. Run `npx musubix3 trace check --strict --json`.
+   Distinguish malformed IDs, dangling endpoints, stale inputs, and missing
+   mandatory design/implementation/test coverage. Non-strict coverage warnings
+   are not a release gate pass.
+3. Use `npx musubix3 trace impact REQ-FEATURE-001 --json` (or a source path).
+   Explain each result with its returned traversal path. Bidirectional
+   connectivity is conservative, not a prediction of behavioral impact.
+4. Use `sdd-formal-codegraph` for import/call evidence beyond explicit traces.
+   Explicit Formal JSON additionally requires model-correspondence validation:
+   generated trace evidence must reach an authoritative passing test.
+   Let native planning/editing make substantive repairs; never add annotations
+   or proxy source files solely to disguise unimplemented or untested requirements.
+5. Rebuild after any source/artifact change. Never maintain trace JSON by hand.
+   Use `npx musubix3 status` for one-shot readiness; do not start a watcher.

package/CHANGELOG.md

@@ -0,0 +1,152 @@
+# Changelog
+
+## Unreleased
+
+## 0.1.0 - 2026-09-07
+
+- Add SHA-pinned cross-platform CI, reproducible native/formal toolchains, and
+  release automation for version checks, package/SBOM/checksum artifacts,
+  strict GitHub OIDC-bound ephemeral-key attestations, GitHub Releases, and
+  separately approved npm provenance publishing.
+- Stream workflow transcript verification with fail-closed total-byte,
+  per-line-byte, and event-count limits while preserving raw and canonical
+  transcript hashes.
+- Add P4 fail-closed model-to-implementation correspondence evidence connecting
+  each explicit Formal JSON requirement through fresh generated trace evidence
+  to an authoritative test passed by a fresh structured command report.
+- Add dependency-free schema-v1 requirement-scoped mutation evidence with
+  deterministic identities, source/test fingerprints, operator/location,
+  command/report provenance, strict policy protection, attestation heads, CLI
+  validation, and adversarial tamper/staleness coverage.
+- Stabilize signed performance evidence across equivalent repeated gate runs by
+  hashing normalized semantic results while retaining volatile run, execution,
+  timestamp, report-hash, and provenance fields in `performance.json`.
+- Extend trusted policy baselines to prevent weakening strict workflow session
+  and freshness constraints or CI-required/strict-OIDC attestation identity and
+  key binding.
+- Replace change/TDD wall-clock ordering with a shared SHA-256-linked monotonic
+  order ledger and explicit migration diagnostics for legacy chronology.
+- Bind stable non-attestation quality verdicts and widened formal solver,
+  coverage, consistency, and artifact fields into attestations without a
+  circular dependency.
+- Persist stdout-native adapter reports for freshness/tamper validation, add
+  strict transcript freshness bounds, collision-safe formal grouping, explicit
+  OIDC signature/algorithm/key negative coverage, and failed/missing reporting
+  for absent CI-required attestations.
+- Add configurable attestation age/future-skew enforcement and an opt-in,
+  fail-closed GitHub Actions OIDC mode that verifies issuer metadata/JWKS,
+  JWT signatures and identity claims, and authorizes either an ephemeral
+  Ed25519 public key or a statically trusted key ID through a bound audience.
+- Bind every deterministic performance observation to a gate-generated run and
+  tamper-evident command/report provenance record, rejecting altered or duplicate
+  reports, failed/skipped test counters, configuration drift, and untraceable
+  observations while extending completeness, freshness, and attestation heads.
+- Strengthen explicit formal constraints with temporal lower bounds and interval
+  conflicts, exact integer normalization for compatible duration and size units,
+  branch-consistent conditional consequences, faithful transition obligations,
+  scalable explicit-witness Lean proofs, and native Z3/Lean mixed-model tests.
+- Add an opt-in strict Code Graph mode that upgrades unresolved computed
+  imports/requires from compatibility warnings to gate-blocking errors, protects
+  the setting in policy baselines, and preserves safe cache-busting resolution.
+- Add opt-in strict Copilot JSONL workflow verification with terminal session
+  identity, successful result enforcement, causal timestamp/tool lifecycle
+  checks, canonical transcript hashing, expected-session matching, and
+  Ed25519-bound workflow evidence heads without claiming GitHub/OIDC origin.
+- Add executable CI integration contracts for every built-in test adapter
+  (Vitest, Jest, pytest, Go test, Cargo and JUnit), including unrelated failing
+  tests that prove target isolation and authentic native-report normalization.
+- Create native report parent directories before execution so Jest and other
+  file reporters can write fresh evidence, and replace the unsupported JUnit
+  method-name option with exact `@Tag("TEST-*")` selection plus no-test failure.
+- Add strict optional `Formal:` JSON constraints for conditional implications,
+  integer bounds, bounded response time, and state transitions, with deterministic
+  coverage plus SMT-LIB2 and Lean translations.
+- Add fail-closed Ed25519 CI evidence attestations bound to repository, commit,
+  CI provider/run ID, and deterministic evidence heads; private keys remain
+  outside musubix3.
+- Add Vitest/Jest, pytest, Go test, Cargo and JUnit adapters for targeted TDD
+  arguments and native-result normalization while preserving custom reports;
+  filter unrelated skipped tests and use runner-valid identifier conventions.
+- Require one distinct, completed, ordered Copilot Skill tool call for every
+  completed workflow declaration, with one final declaration per Skill invocation.
+- Resolve package-manifest entrypoints and safe local cache-busting dynamic
+  imports while retaining warnings for arbitrary computed loading.
+- Strengthen staged-change completeness with measurable Acceptance criteria,
+  concrete design fields, authoritative test declarations, exact CHANGE
+  requirement enumeration, and deterministic operation-budget evidence.
+- Chain every TDD phase into an append-only SHA-256 ledger and reject missing,
+  reordered, altered, duplicate, or orphaned phase records.
+- Scope staged implementation fingerprints to each changed requirement's linked
+  code and Code Graph dependencies, so unrelated source edits cannot satisfy it.
+- Replace `test-identities` output substring matching with fresh structured
+  command reports that prove every annotated test actually passed.
+- Add functional/non-functional requirement classification and an automatic
+  per-CHANGE completeness gate for requirements, design, ADR, code, tests, TDD,
+  and trace evidence.
+- Automatically require workflow and TDD validation whenever their evidence is
+  present, and require TDD for every staged change document.
+- Require test-scoped `tddArgs`, target-specific failed/passed output, and a
+  non-test source change between Red and Green.
+- Require a fresh structured per-test JSON report; missing, malformed, skipped,
+  errored, or multi-test reports cannot satisfy a TDD phase.
+- Reject legacy/unscoped TDD evidence and identical phase output reused across
+  different tests.
+- Fingerprint the annotated JS/TS test declaration instead of the entire test
+  file, so adding an unrelated test does not invalidate existing TDD cycles.
+- Preserve repeated TDD cycles append-only so later reruns cannot erase the
+  historical Red/Green evidence referenced by staged changes.
+- Add `workflow-verify` to reconcile declarations with actual Copilot JSONL
+  Skill invocation events and invalidate verification after declaration changes.
+- Add ordered `change-record` checkpoints and a `change-history` gate for
+  requirements, design, test, implementation, and TDD chronology.
+- Require a one-to-one match between `CHANGE-*.md` documents and chronology
+  records; an unrecorded document or orphan record blocks readiness.
+- Require each affected requirement's Red after the requirements checkpoint and
+  its matching Green after the implementation checkpoint, preventing reuse of
+  pre-change TDD cycles.
+- Require every mandatory requirement to have a valid Red-Green cycle from an
+  authoritative verifying test when the TDD gate is enabled.
+- Prohibit Skills from substituting `musubix`, `musubix2`, or other similarly
+  named packages when the exact `musubix3` CLI is unavailable.
+- Added `sdd-change`, an integrated feature/change/fix workflow that propagates
+  observable behavior through requirements, design, implementation, tests,
+  traceability, graph evidence, and the final quality gate.
+- Added reproducible SMT-LIB2 and Lean artifact generation with SHA-256 metadata.
+- Added `formal doctor`, configurable solver executables, Lake fallback, versions,
+  execution duration, and configurable timeouts.
+- Replaced Lean's concrete assignment check with decidable satisfiability and
+  unsatisfiability theorems for the documented Boolean abstraction.
+- Added Japanese unconditional obligation/prohibition normalization so bilingual
+  requirements can participate in formal consistency checks.
+- Added authoritative comment-trace scanning for Rust, Python, Go, Java/Kotlin,
+  C/C++, C#, Ruby, PHP and Swift, with string-literal masking.
+- Prohibited synthetic trace proxy files in the implementation, traceability and
+  integrated change Skills.
+- Added explicit `GRAPH_UNSUPPORTED_LANGUAGE` evidence for non-JS/TS sources.
+- Excluded transient logs, JSONL sessions and installed Skill copies from quality
+  evidence freshness fingerprints.
+- Added native Rust, Python, Go, Java, C/C++, C#, PHP, R and Julia
+  import/module/include/source, symbol and direct-call graph indexing.
+- Added optional formal and executed-test-identity quality gates with persisted
+  formal coverage evidence.
+- Added a trusted policy baseline, preserved changed-run context, workflow event
+  manifests with command hashes, N/A link coverage, and duplicate requirement
+  statement detection.
+- Added verified TDD evidence commands for Red, Green and Refactor phases,
+  requiring linked requirement/test IDs, observed test IDs, expected exit states,
+  stable test fingerprints and consistent command hashes.
+
+## 0.1.0-rc.1
+
+- Clean TypeScript ESM workspaces for domain checks, analysis and the `musubix3` CLI.
+- Seven bilingual GitHub Copilot CLI skills; root plugin and native marketplace.
+- Preservation-first npm installer with dry-run and injectable native plugin install.
+- Six controlled EARS patterns, versioned measurable constitution, explicit designs.
+- Generated trace graphs, bidirectional impact and coverage/staleness diagnostics.
+- Compiler-based JS/TS dependency indexing, reverse impact, cycles and architecture rules.
+- Local TF-IDF retrieval with bounded Git co-change/contribution evidence.
+- Conservative deterministic consistency checks and optional real Z3/Lean adapters.
+- Actual command quality gates with pass/fail/skipped, changed-file context and status.
+- Tests, Node 20/24 CI and npm package-content verification.
+
+This is a new artifact schema. No musubix2 migration or compatibility is provided.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 nahisaho
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.