opensdd 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1,494 @@
1
+ # Spec Format
2
+
3
+ > Defines the standard format for behavioral specifications in the OpenSDD (Open Spec-Driven Development) protocol.
4
+
5
+ ## Version
6
+
7
+ 0.1.0
8
+
9
+ ## Overview
10
+
11
+ A "spec" is a behavioral contract for a piece of software. Unlike source code, a spec defines **what** software does and **what constraints** it must satisfy, while leaving **how** it is implemented to the consuming agent.
12
+
13
+ A spec MAY optionally declare a target language, runtime, or framework (e.g., "This is a Node.js CLI tool") when the spec is inherently tied to a specific platform. When a spec declares a target platform, the implementing agent MUST use that platform. When a spec does not declare a target platform, the agent reads the spec alongside the consumer's project context (language, framework, conventions) and generates a bespoke implementation.
14
+
15
+ Specs exist in two contexts:
16
+
17
+ - **Authored spec** (`opensdd/spec.md`) — the spec that a project defines as its source of truth. Development is spec-first: the spec is edited, then code is updated to match. It can be published to a registry for others to consume.
18
+ - **Installed dependency specs** (`.opensdd.deps/`) — specs pulled from a registry and installed into a consumer project. The `.opensdd.deps/` directory is committed to the repo so that installed specs are always available without requiring a registry fetch.
19
+
20
+ A project MAY be both an author (has `opensdd/spec.md`) and a consumer (has `.opensdd.deps/` with installed dependencies). These are independent concerns tracked in a single `opensdd.json` manifest.
21
+
22
+ In a monorepo, each sub-project that needs its own spec maintains its own `opensdd.json`, `opensdd/`, and `.opensdd.deps/` at its sub-project root — the same way each package in an npm workspace has its own `package.json`. The CLI always operates relative to the nearest `opensdd.json` in the directory hierarchy.
23
+
24
+ The OpenSDD protocol installs two skills into the project: **sdd-manager** teaches agents how to implement, update, and verify installed dependency specs; **sdd-generate** teaches agents how to generate specs from existing code. Individual specs are not skills — they are data that the skills operate on.
25
+
26
+ Skills are installed into the native configuration format of each supported coding agent so they are automatically discovered. The canonical skill content follows the Agent Skills standard (agentskills.io) with `SKILL.md` files; adapter files are generated for agents with different configuration systems. See the CLI spec for the full installation mapping. Supported agents:
27
+
28
+ - **Claude Code** — `.claude/skills/<name>/SKILL.md` (Agent Skills standard, native)
29
+ - **OpenAI Codex CLI** — `.agents/skills/<name>/SKILL.md` (Agent Skills standard, native)
30
+ - **Cursor** — `.cursor/rules/<name>.md` (rules with YAML frontmatter)
31
+ - **GitHub Copilot** — `.github/instructions/<name>.instructions.md` (instructions with YAML frontmatter)
32
+ - **Gemini CLI** — `GEMINI.md` updated with `@` imports referencing the canonical skill files
33
+ - **Amp** — `AGENTS.md` updated with `@` references to the canonical skill files
34
+
35
+ ## Requirement Level Keywords
36
+
37
+ This spec and all specs written in the OpenSDD format use requirement level keywords as defined in [RFC 2119](https://www.rfc-editor.org/rfc/rfc2119). The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" are to be interpreted as described in RFC 2119.
38
+
39
+ Spec authors MUST use these keywords in behavioral contracts and invariants to distinguish between hard requirements, recommendations, and optional behaviors.
40
+
41
+ ## Behavioral Contract
42
+
43
+ ### Spec Structure
44
+
45
+ A spec is a directory containing spec files. The directory name is the bare spec name — lowercase alphanumeric and hyphens only.
46
+
47
+ #### Required files
48
+
49
+ In the registry and in installed dependency specs (`.opensdd.deps/`), every spec directory MUST contain:
50
+
51
+ - `manifest.json` — Metadata about the spec (name, version, spec_format, description, dependencies).
52
+ - `spec.md` — The behavioral contract and acceptance criteria. The spec IS the acceptance criteria — a well-written spec contains everything needed to both implement and verify the software.
53
+
54
+ For the authored spec (`opensdd/`), the directory contains `spec.md` and any supplementary files. The metadata that would be in `manifest.json` lives in the `opensdd.json` `publish` entry instead; a separate `manifest.json` file is constructed during publishing.
55
+
56
+ The spec author MAY include additional files in the spec directory (e.g., supplementary schema definitions, sub-specs for components, reference schemas). The protocol does not mandate any particular directory structure beyond the required files — organization of supplementary files is at the author's discretion.
57
+
58
+ `spec.md` SHOULD use relative markdown hyperlinks to reference any supplementary files. `spec.md` is the starting point for reading the spec; all other files in the spec directory MUST be reachable by following links from `spec.md` (directly or transitively). This makes the spec self-navigating — an agent reading `spec.md` can discover and follow links to component specs, schema definitions, or other supporting documents as needed.
59
+
60
+ #### Consumer additions (installed dependency specs only)
61
+
62
+ - `deviations.md` — Consumer-owned. Documents intentional divergences from the spec. MUST NOT be created by the registry or install process; only created by the consumer (or their agent) when they choose to deviate.
63
+
64
+ #### File ownership (installed dependency specs)
65
+
66
+ All files installed from the registry (`manifest.json`, `spec.md`, and any supplementary files) are **spec-owned** — they are overwritten on update and the consumer MUST NOT edit them. `deviations.md` is **consumer-owned** — it MUST NOT be created, modified, or deleted by the CLI or any automated tooling. Only the consumer or their agent (acting on explicit user instruction) may create or edit `deviations.md`.
67
+
68
+ Files in `opensdd/` are fully owned by the author — there is no ownership distinction.
69
+
70
+ ### spec.md Format
71
+
72
+ The spec is both the behavioral contract and the acceptance criteria. A well-written spec MUST contain everything an agent needs to implement the software AND verify that the implementation is correct. The spec's inline examples, edge cases, and invariants ARE the acceptance criteria.
73
+
74
+ The primary audience for a spec is an AI agent implementing the described software. The format prioritizes content completeness over structural rigidity — agents can parse natural language documents regardless of heading structure.
75
+
76
+ #### Required Structure
77
+
78
+ A spec MUST contain:
79
+
80
+ 1. **Header** — the spec name as an H1, followed by a one-line blockquote summary.
81
+
82
+ ```markdown
83
+ # {name}
84
+
85
+ > {one-line description of what this software does}
86
+ ```
87
+
88
+ 2. **Behavioral Contract** — an H2 section (`## Behavioral Contract`) containing one or more H3 subsections describing the software's behavior. Each subsection covers a logical grouping of functionality. For each behavior, the spec MUST define what inputs are accepted, what outputs are produced, what side effects occur (if any), and how errors are handled. Behaviors MUST describe **what** happens, not **how**. Implementation details (data structures, algorithms, internal architecture) MUST NOT appear in this section.
89
+
90
+ Beyond these two requirements, the spec author is free to organize supplementary content however best serves clarity. The sections below are RECOMMENDED patterns that have proven valuable, but they are not structurally required.
91
+
92
+ #### Inline Examples
93
+
94
+ Each behavioral subsection MAY include inline examples demonstrating the expected behavior with concrete inputs and outputs. Inline examples are most valuable for behaviors that benefit from concrete demonstration — simple or self-explanatory behaviors do not require them. When present, inline examples serve as both documentation and behavioral anchors — they ground the spec in concrete inputs and outputs that make the intended behavior unambiguous.
95
+
96
+ For pure/stateless behavior, use direct input/output examples:
97
+
98
+ ```markdown
99
+ ### Core Behavior
100
+
101
+ Accepts a string input and returns a URL-friendly slug.
102
+
103
+ - `slugify("Hello World")` MUST return `"hello-world"`
104
+ - `slugify("Déjà Vu")` MUST return `"deja-vu"`
105
+ - `slugify(" --foo- ")` MUST return `"foo"`
106
+ ```
107
+
108
+ For stateful, async, or side-effect-heavy behavior, use narrative scenarios with RFC 2119 keywords:
109
+
110
+ ```markdown
111
+ ### Retry Behavior
112
+
113
+ When a request fails with a transient error (5xx status or network timeout),
114
+ the client MUST retry up to the configured maximum attempts.
115
+
116
+ Given an endpoint that fails twice then succeeds:
117
+ - After the first failure, the client MUST wait approximately `baseDelay` before retrying
118
+ - After the second failure, the client MUST wait approximately `baseDelay * 2` before retrying
119
+ - The third attempt MUST succeed and return the response
120
+
121
+ Given an endpoint that always returns 503:
122
+ - The client MUST attempt exactly `maxRetries + 1` total requests
123
+ - After exhausting retries, the client MUST throw `Error(RetriesExhausted)`
124
+ ```
125
+
126
+ Spec authors MAY include diagrams (mermaid, ASCII) to illustrate state machines, data flows, or complex interactions where a visual representation aids comprehension.
127
+
128
+ #### Recommended Sections
129
+
130
+ The following sections are RECOMMENDED for well-rounded specs. They can appear in any order and may be organized however the author prefers — as dedicated H2 sections, inline within the Behavioral Contract, or in supplementary files linked from `spec.md`.
131
+
132
+ **Edge Cases** — Explicitly enumerate edge cases and the expected behavior for each. When included, edge cases SHOULD have concrete examples. Behaviors that might be "obvious" to a human reader SHOULD be stated explicitly for reliable agent implementation. Edge cases may alternatively be woven into the relevant Behavioral Contract subsections rather than separated out.
133
+
134
+ ```markdown
135
+ ## Edge Cases
136
+
137
+ - Empty string: `slugify("")` MUST return `""`
138
+ - Whitespace only: `slugify(" ")` MUST return `""`
139
+ - Already valid: `slugify("hello-world")` MUST return `"hello-world"`
140
+ - Consecutive separators: `slugify("foo---bar")` MUST return `"foo-bar"`
141
+ ```
142
+
143
+ **NOT Specified (Implementation Freedom)** — Explicitly list aspects left to the implementer's discretion. This helps prevent agents from over-constraining their implementation to match perceived spec intent. Particularly valuable for specs where the boundary between contract and freedom is non-obvious.
144
+
145
+ **Invariants** — Properties that MUST hold true across all inputs and states. These are universal assertions that translate directly into tests. Invariants SHOULD be expressed as testable assertions:
146
+
147
+ ```markdown
148
+ ## Invariants
149
+
150
+ - For any string `x`: `slugify(slugify(x)) === slugify(x)` (idempotent)
151
+ - For any string `x`: the output MUST match pattern `^[a-z0-9]+(-[a-z0-9]+)*$` or be empty
152
+ ```
153
+
154
+ **Options / Configuration** — Configurable parameters with name, type, default value, and description of effect. Options SHOULD include inline examples.
155
+
156
+ **Implementation Hints** — Guidance that helps agents make better choices — performance, data size, common pitfalls, concurrency considerations. When the spec does not declare a target platform, implementation hints SHOULD be language-agnostic. When the spec targets a specific platform, hints MAY reference platform-specific tools, libraries, or idioms. Implementation hints MUST NOT contain behavioral requirements; any requirement that affects correctness belongs in the Behavioral Contract.
157
+
158
+ **Version** — The spec's semantic version number. When installed as a dependency, the canonical version lives in `opensdd.json`; this section provides a human-readable reference.
159
+
160
+ **Overview** — Brief description of the spec's purpose and context. MUST NOT contain behavioral requirements.
161
+
162
+ ### deviations.md Format
163
+
164
+ Consumer-owned file documenting intentional divergences from an installed dependency spec. Only created when a consumer actually deviates. Not relevant for authored specs in `opensdd/` — the author simply edits the spec directly.
165
+
166
+ Each deviation is an H2 section:
167
+
168
+ ```markdown
169
+ ## {short-name} ({deviation-type})
170
+
171
+ **Spec section:** {which section of spec.md this deviates from, or `*` for entire spec}
172
+ **Type:** {feature-omitted | behavior-modified | behavior-narrowed | feature-added}
173
+ **Reason:** {why the consumer chose to deviate}
174
+ **Test impact:** {which spec sections or inline examples to skip during verification}
175
+ ```
176
+
177
+ Deviation types:
178
+ - `feature-omitted` — A spec capability is intentionally not implemented.
179
+ - `behavior-modified` — A behavior is implemented differently (with explanation).
180
+ - `behavior-narrowed` — A behavior is implemented with reduced scope.
181
+ - `feature-added` — Consumer added behavior beyond the spec (documented for clarity).
182
+
183
+ ### Spec Dependencies
184
+
185
+ A spec MAY depend on other specs for shared types, interfaces, or behavioral contracts. Dependencies are declared in the spec's `dependencies` array (in its registry `manifest.json` or in the `publish` entry in `opensdd.json`) and referenced within `spec.md` via markdown links.
186
+
187
+ The implementing agent MUST read all dependency specs before implementation to understand shared types and contracts. When implementing a spec with dependencies, the agent MUST ensure its implementation is compatible with the dependency's interface.
188
+
189
+ ### OpenSDD-Compliant Repos
190
+
191
+ An OpenSDD-compliant repo uses specs as the source of truth for desired behavior. Code flows from the spec, not the other way around.
192
+
193
+ ```
194
+ my-project/
195
+ opensdd.json # Manifest: publish config + dependencies
196
+ opensdd/ # This project's authored spec
197
+ spec.md
198
+ .opensdd.deps/ # Installed dependency specs
199
+ slugify/
200
+ spec.md
201
+ src/
202
+ ...
203
+ ```
204
+
205
+ In a monorepo, each sub-project maintains its own OpenSDD layer:
206
+
207
+ ```
208
+ my-monorepo/
209
+ packages/
210
+ auth/
211
+ opensdd.json
212
+ opensdd/
213
+ spec.md
214
+ .opensdd.deps/
215
+ src/
216
+ payments/
217
+ opensdd.json
218
+ opensdd/
219
+ spec.md
220
+ .opensdd.deps/
221
+ src/
222
+ ```
223
+
224
+ The CLI resolves `opensdd.json` by searching upward from the current working directory, similar to how npm resolves `package.json`. Each sub-project is independent — it has its own authored spec, its own dependencies, and its own publish configuration.
225
+
226
+ #### Spec-first development
227
+
228
+ The development methodology for an OpenSDD-compliant repo:
229
+
230
+ 1. **Edit the spec** — all behavior changes start in `opensdd/spec.md`. The spec is the source of truth.
231
+ 2. **Update the code** — the developer or their AI agent updates the implementation to match the spec. The protocol is deliberately not prescriptive about this step — the agent reads the spec, understands what changed, and updates the code accordingly.
232
+ 3. **Publish** — when the spec and implementation are in sync, the developer publishes the spec version to the registry via `opensdd publish`.
233
+
234
+ The protocol does not mandate a specific tooling flow for step 2 (e.g., changesets, diffs). The spec is always readable in full, and any capable agent can compare the spec against the implementation to identify gaps.
235
+
236
+ #### Publishing
237
+
238
+ A project publishes its spec by declaring it in `opensdd.json` under `publish` and running `opensdd publish`. The CLI reads the spec files from `opensdd/`, constructs the registry entry, and pushes it to the registry. See the CLI spec for full publishing behavior.
239
+
240
+ ### Consumer Repos
241
+
242
+ Any repo that installs specs from the registry is a consumer. The consumer workflow:
243
+
244
+ 1. `opensdd install <name>` — fetches the spec from the registry and places it in `.opensdd.deps/<name>/`.
245
+ 2. Agent implements the spec using the sdd-manager skill.
246
+ 3. `opensdd update [name]` — pulls newer versions, stages changesets in `.opensdd.deps/.updates/` for the agent to process.
247
+
248
+ The `.opensdd.deps/` directory MUST be committed to the repo. This ensures that installed specs are always present and verified — `opensdd.json` serves as the source of truth for which specs and versions are installed, and the committed deps directory confirms those specs were actually fetched and installed.
249
+
250
+ ### opensdd.json Manifest
251
+
252
+ The `opensdd.json` file is the project-level manifest. It lives at the project root and is created by `opensdd init`. It serves both authors (via `publish`) and consumers (via `dependencies`).
253
+
254
+ ```json
255
+ {
256
+ "opensdd": "0.1.0",
257
+ "registry": "https://github.com/deepagents-ai/opensdd",
258
+ "specs_dir": "opensdd",
259
+ "deps_dir": ".opensdd.deps",
260
+ "publish": {
261
+ "name": "auth",
262
+ "version": "1.0.0",
263
+ "description": "Authentication with multiple provider support",
264
+ "spec_format": "0.1.0",
265
+ "dependencies": []
266
+ },
267
+ "dependencies": {
268
+ "slugify": {
269
+ "version": "2.1.0",
270
+ "source": "https://github.com/deepagents-ai/opensdd",
271
+ "spec_format": "0.1.0",
272
+ "implementation": null,
273
+ "tests": null,
274
+ "has_deviations": false
275
+ }
276
+ }
277
+ }
278
+ ```
279
+
280
+ #### Top-level fields
281
+
282
+ - `opensdd` (required): Protocol version string. Agents and the CLI MUST use this to determine how to interpret the manifest.
283
+ - `registry` (optional): URL of the default registry. Overridden by the CLI's `--registry` flag. Default: `"https://github.com/deepagents-ai/opensdd"`.
284
+ - `specs_dir` (optional): Relative path from the project root to the directory containing the authored spec. Default: `"opensdd"`.
285
+ - `deps_dir` (optional): Relative path from the project root to the directory containing installed dependency specs. Default: `".opensdd.deps"`.
286
+ - `publish` (optional): Object defining the spec this project publishes. Omit if the project only consumes specs.
287
+ - `dependencies` (optional): Object keyed by spec name. Each entry tracks an installed dependency spec. Omit if the project only publishes specs.
288
+
289
+ #### Publish fields
290
+
291
+ - `name` (required): Bare spec name — lowercase alphanumeric and hyphens only.
292
+ - `version` (required): Semver version of the spec being developed.
293
+ - `description` (required): One-line description for registry display.
294
+ - `spec_format` (required): Which version of the OpenSDD protocol this spec targets.
295
+ - `dependencies` (optional): Array of bare spec names that this spec references for shared types or behavioral contracts.
296
+
297
+ #### Dependency entry fields
298
+
299
+ - `version` (required): Semver version of the installed spec.
300
+ - `source` (required): URL of the registry this spec was installed from.
301
+ - `spec_format` (required): OpenSDD protocol version of the installed spec.
302
+ - `implementation` (consumer-managed): Path to the generated implementation file, `null` until implemented.
303
+ - `tests` (consumer-managed): Path to the generated test file, `null` until implemented.
304
+ - `has_deviations` (consumer-managed): Boolean, `false` until a deviation is created.
305
+
306
+ Consumer-managed fields MUST be present with explicit `null` or `false` values rather than omitted. Fields MUST survive all update operations.
307
+
308
+ ### Registry
309
+
310
+ A registry is a versioned store of published specs. The default registry is the `registry/` directory in the OpenSDD GitHub repository (`https://github.com/deepagents-ai/opensdd`).
311
+
312
+ #### Structure
313
+
314
+ ```
315
+ registry/
316
+ slugify/
317
+ index.json # Spec metadata and version list
318
+ 2.1.0/
319
+ manifest.json # Version-specific metadata
320
+ spec.md
321
+ 2.2.0/
322
+ manifest.json
323
+ spec.md
324
+ http-retry/
325
+ index.json
326
+ 1.0.0/
327
+ manifest.json
328
+ spec.md
329
+ ```
330
+
331
+ #### index.json
332
+
333
+ Each spec in the registry MUST have an `index.json` at its root:
334
+
335
+ ```json
336
+ {
337
+ "name": "slugify",
338
+ "description": "String to URL-friendly slug",
339
+ "latest": "2.2.0",
340
+ "versions": {
341
+ "2.1.0": { "spec_format": "0.1.0" },
342
+ "2.2.0": { "spec_format": "0.1.0" }
343
+ }
344
+ }
345
+ ```
346
+
347
+ - `name` (required): Bare spec name.
348
+ - `description` (required): One-line description.
349
+ - `latest` (required): The most recent published version.
350
+ - `versions` (required): Object keyed by semver version string. Each entry MAY include summary metadata (e.g., `spec_format`).
351
+
352
+ #### manifest.json (per version)
353
+
354
+ Each version directory MUST contain a `manifest.json`:
355
+
356
+ ```json
357
+ {
358
+ "name": "slugify",
359
+ "version": "2.2.0",
360
+ "spec_format": "0.1.0",
361
+ "description": "String to URL-friendly slug",
362
+ "dependencies": []
363
+ }
364
+ ```
365
+
366
+ - `name` (required): Bare spec name.
367
+ - `version` (required): Semver version of this entry.
368
+ - `spec_format` (required): OpenSDD protocol version.
369
+ - `description` (required): One-line description.
370
+ - `dependencies` (optional): Array of bare spec names.
371
+
372
+ #### Conventions
373
+
374
+ - The registry MUST NOT contain `deviations.md` files.
375
+ - The registry is the source of truth for spec-owned files.
376
+ - Spec names MUST be lowercase alphanumeric and hyphens only.
377
+ - Version directories MUST be valid semver strings.
378
+
379
+ ### Update Staging
380
+
381
+ When a dependency spec is updated via `opensdd update`, the CLI stages the update rather than immediately modifying `opensdd.json`. This creates a two-phase workflow: the spec files are updated first, the agent processes the changes, and only after the user confirms the migration is complete does `opensdd update apply` finalize the `opensdd.json` entry.
382
+
383
+ Staged updates live in `.opensdd.deps/.updates/`, with one directory per spec:
384
+
385
+ ```
386
+ .opensdd.deps/
387
+ .updates/
388
+ slugify/
389
+ changeset.md # Unified diffs and change summary
390
+ manifest.json # Metadata to apply to opensdd.json
391
+ payments/
392
+ changeset.md
393
+ manifest.json
394
+ ```
395
+
396
+ #### changeset.md
397
+
398
+ Captures everything the agent needs to understand and process the update without re-reading the entire spec from scratch.
399
+
400
+ ```markdown
401
+ # Changeset: {name}
402
+
403
+ **Previous version:** {old semver}
404
+ **New version:** {new semver}
405
+ **Spec-format:** {old version} → {new version} (or "unchanged")
406
+ **Date:** {ISO 8601 date}
407
+
408
+ ## Changed Files
409
+
410
+ ### spec.md
411
+
412
+ \`\`\`diff
413
+ {unified diff of spec.md}
414
+ \`\`\`
415
+
416
+ ### {other-file}
417
+
418
+ \`\`\`diff
419
+ {unified diff, if changed}
420
+ \`\`\`
421
+ ```
422
+
423
+ The changeset MUST include unified diffs for every changed spec-owned file. Staleness detection for deviations is delegated to the agent (via the sdd-manager skill) rather than the CLI, since the agent can perform semantic analysis of whether a deviation is affected by the changes.
424
+
425
+ #### manifest.json (staged update)
426
+
427
+ Contains the metadata needed to finalize the `opensdd.json` dependency entry when `opensdd update apply` is called:
428
+
429
+ ```json
430
+ {
431
+ "name": "slugify",
432
+ "previous_version": "2.1.0",
433
+ "version": "2.2.0",
434
+ "source": "https://github.com/deepagents-ai/opensdd",
435
+ "spec_format": "0.1.0"
436
+ }
437
+ ```
438
+
439
+ This is a transient artifact. `opensdd update apply` reads this file, applies the metadata to `opensdd.json`, and deletes the staging directory.
440
+
441
+ ### SDD-Manager Skill
442
+
443
+ The sdd-manager skill teaches agents how to implement, update, and verify installed dependency specs. It is installed once per project via `opensdd init` alongside the sdd-generate skill, into each supported agent's configuration directory. See [sdd-manager.md](sdd-manager.md) for the full skill workflow, including implementation defaults, the project conventions check, and the verification protocol.
444
+
445
+ ### SDD-Generate Skill
446
+
447
+ The sdd-generate skill teaches agents how to generate a spec from existing code. See [sdd-generate.md](sdd-generate.md) for the full skill workflow.
448
+
449
+ ### Versioning
450
+
451
+ Specs use semantic versioning:
452
+ - **Major**: Breaking change to the behavioral contract
453
+ - **Minor**: Additive change (new optional behavior, new options with backwards-compatible defaults)
454
+ - **Patch**: Clarification, additional inline examples, documentation improvement
455
+
456
+ ## Edge Cases
457
+
458
+ - Only the H1 header, blockquote summary, and `## Behavioral Contract` are required. All other sections (Edge Cases, NOT Specified, Invariants, Options / Configuration, Implementation Hints) are recommended but optional.
459
+ - A spec dependency that is not installed: the implementing agent MUST warn the user but MAY proceed if the dependent types can be inferred from context.
460
+ - `deviations.md` referencing a spec section removed in an update: the agent SHOULD flag the deviation as potentially stale during the Update workflow.
461
+ - Extra fields in a dependency's `opensdd.json` entry beyond those defined by this format: extra fields MUST be preserved during updates and MUST NOT cause errors.
462
+ - Circular spec dependencies (A depends on B, B depends on A): not currently supported. The implementing agent MUST detect and report the cycle rather than recursing infinitely.
463
+ - `opensdd.json` dependency entry exists but spec directory is missing in `.opensdd.deps/`: the CLI MUST warn and offer to re-install from registry.
464
+ - Spec directory exists in `.opensdd.deps/` but no `opensdd.json` dependency entry: the CLI MUST warn. The spec is not tracked.
465
+ - Publishing a spec with the same version that already exists in the registry: the CLI MUST reject the publish and suggest bumping the version.
466
+ - A project with `opensdd/` but no `publish` in `opensdd.json`: valid — the spec is local-only and not published.
467
+
468
+ ## NOT Specified (Implementation Freedom)
469
+
470
+ - The internal implementation of the sdd-manager skill (exact prompt wording, instruction structure)
471
+ - How agents discover the sdd-manager skill (defined by the Agent Skills standard)
472
+ - The transport mechanism for fetching specs from a registry (defined by the CLI spec)
473
+ - How agents generate implementations (model choice, prompting strategy, temperature)
474
+ - The specific testing framework or test runner (determined by the consumer's project)
475
+ - How spec dependencies are resolved when circular (not currently supported)
476
+ - The sdd-generate skill's internal workflow (separate concern)
477
+ - File encoding (assumed UTF-8)
478
+ - How the author syncs implementation with spec changes (the protocol is deliberately not prescriptive about this)
479
+ - The exact mechanism for authenticating with the registry during publish (deferred to local git/gh credentials)
480
+
481
+ ## Invariants
482
+
483
+ - A registry or installed spec directory MUST always contain `manifest.json` and `spec.md`
484
+ - Spec-owned files in `.opensdd.deps/` MUST NOT be modified by the consumer or their agent
485
+ - `deviations.md` MUST NOT be created, modified, or deleted by the CLI or any automated tooling
486
+ - Consumer-managed fields in `opensdd.json` MUST survive all update operations
487
+ - Every installed dependency spec MUST have both a directory in `deps_dir` and an entry in `opensdd.json` `dependencies`
488
+ - All behaviors described in the spec MUST be thoroughly tested by the implementing agent
489
+ - A `spec.md` MUST contain an H1 header with blockquote summary and a `## Behavioral Contract` section
490
+ - `deviations.md` MUST only be created when a deviation actually exists
491
+ - Every dependency implementation MUST be accompanied by a generated test suite that passes
492
+ - The test suite MUST thoroughly cover all behaviors described in the spec (minus documented deviations)
493
+ - The `.opensdd.deps/` directory MUST be committed to the repo
494
+ - Publishing MUST NOT allow overwriting an existing version in the registry
package/package.json ADDED
@@ -0,0 +1,31 @@
1
+ {
2
+ "name": "opensdd",
3
+ "version": "0.1.0",
4
+ "description": "The official OpenSDD (Open Spec-Driven Development) CLI, spec, and spec registry",
5
+ "type": "module",
6
+ "bin": {
7
+ "opensdd": "./bin/opensdd.js"
8
+ },
9
+ "files": [
10
+ "bin/",
11
+ "src/",
12
+ "opensdd/"
13
+ ],
14
+ "engines": {
15
+ "node": ">=18.0.0"
16
+ },
17
+ "scripts": {
18
+ "test": "node --test test/**/*.test.js"
19
+ },
20
+ "keywords": [
21
+ "opensdd",
22
+ "spec",
23
+ "specification",
24
+ "behavioral-contract",
25
+ "sdd"
26
+ ],
27
+ "license": "MIT",
28
+ "dependencies": {
29
+ "diff": "^7.0.0"
30
+ }
31
+ }