pumuki 6.3.126 → 6.3.128

package/CHANGELOG.md

@@ -6,6 +6,14 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [6.3.127] - 2026-04-28
+
+### Fixed
+
+- **Baseline enterprise fully active by default:** `sdd`, `heuristics`, `learning_context`, `analytics`, `operational_memory` and `saas_ingestion` now resolve as `strict source=default blocking=true`, aligned with `pre_write` and `mcp_enterprise`.
+- **No more false default-off messaging:** disabled envelopes now say the feature was switched off explicitly by configuration, avoiding the old misleading “desactivado por defecto” copy.
+- **Regression coverage:** status, lifecycle, MCP and SDD tests now assert that default-off only exists when a test or consumer explicitly sets the corresponding env var to `off`.
+
 ## [6.3.126] - 2026-04-28
 
 ### Fixed

package/VERSION

@@ -1 +1 @@
-v6.3.126
+v6.3.128

package/integrations/config/skillsRuleSet.ts

@@ -21,13 +21,25 @@ export type SkillsRuleSetLoadResult = {
   mappedHeuristicRuleIds: ReadonlySet<string>;
   requiresHeuristicFacts: boolean;
   unsupportedAutoRuleIds?: ReadonlyArray<string>;
+  registryCoverage?: {
+    contract: 'AUTO_RUNTIME_RULES_FOR_STAGE';
+    stage: Exclude<GateStage, 'STAGED'>;
+    registryTotals: {
+      total: number;
+      auto: number;
+      declarative: number;
+    };
+    stageApplicableAutoRuleIds: ReadonlyArray<string>;
+    declarativeRuleIds: ReadonlyArray<string>;
+    excludedDeclarativeReason: string;
+  };
 };
 
 const STAGE_RANK: Record<Exclude<GateStage, 'STAGED'>, number> = {
-  PRE_WRITE: 30,
-  PRE_COMMIT: 30,
+  PRE_WRITE: 10,
+  PRE_COMMIT: 20,
   PRE_PUSH: 30,
-  CI: 30,
+  CI: 40,
 };
 
 const PLATFORM_KEYS: ReadonlyArray<keyof DetectedPlatforms> = [
@@ -445,31 +457,7 @@ const toRuleDefinition = (params: {
     };
   }
 
-  // Declarative rules remain explicit, but AUTO rules without mapping are
-  // excluded from runtime rule conversion and reported separately.
-  return {
-    id: params.rule.id,
-    description: params.rule.description,
-    severity,
-    platform: params.rule.platform,
-    locked: params.rule.locked ?? true,
-    confidence: params.rule.confidence,
-    when: {
-      kind: 'FileContent',
-      regex: ['a^'],
-    },
-    then: {
-      kind: 'Finding',
-      message: `[Declarative] ${params.rule.description}`,
-      code: `${toCode(params.rule.id)}_DECLARATIVE`,
-      source: runtimeIrSource,
-    },
-    scope: resolveScopeForPlatform(
-      params.rule.platform,
-      params.repoRoot,
-      params.observedFilePaths
-    ),
-  };
+  return undefined;
 };
 
 const hasDetectedPlatforms = (detectedPlatforms?: DetectedPlatforms): boolean => {
@@ -546,11 +534,23 @@ export const loadSkillsRuleSetForStage = (
   const rulesById = new Map<string, RuleDefinition>();
   const mappedHeuristicRuleIds = new Set<string>();
   const unsupportedAutoRuleIds = new Set<string>();
+  const registryRuleIds = new Set<string>();
+  const registryAutoRuleIds = new Set<string>();
+  const registryDeclarativeRuleIds = new Set<string>();
+  const stageApplicableAutoRuleIds = new Set<string>();
 
   for (const bundle of activeBundles) {
     const bundlePolicy = policy?.bundles[bundle.name];
 
     for (const compiledRule of bundle.rules) {
+      registryRuleIds.add(compiledRule.id);
+      const evaluationMode = resolveRuleEvaluationMode(compiledRule);
+      if (evaluationMode === 'AUTO') {
+        registryAutoRuleIds.add(compiledRule.id);
+      } else {
+        registryDeclarativeRuleIds.add(compiledRule.id);
+      }
+
       if (
         !isRulePlatformActive({
           rule: compiledRule,
@@ -561,7 +561,13 @@ export const loadSkillsRuleSetForStage = (
       }
 
       const mappedRuleIds = resolveMappedHeuristicRuleIdsForCompiledRule(compiledRule);
-      const evaluationMode = resolveRuleEvaluationMode(compiledRule);
+      if (!stageApplies(stage, compiledRule.stage)) {
+        continue;
+      }
+      if (evaluationMode !== 'AUTO') {
+        continue;
+      }
+      stageApplicableAutoRuleIds.add(compiledRule.id);
       if (evaluationMode === 'AUTO' && mappedRuleIds.length === 0) {
         unsupportedAutoRuleIds.add(compiledRule.id);
         continue;
@@ -596,5 +602,18 @@ export const loadSkillsRuleSetForStage = (
     mappedHeuristicRuleIds,
     requiresHeuristicFacts: mappedHeuristicRuleIds.size > 0,
     unsupportedAutoRuleIds: [...unsupportedAutoRuleIds].sort(),
+    registryCoverage: {
+      contract: 'AUTO_RUNTIME_RULES_FOR_STAGE',
+      stage,
+      registryTotals: {
+        total: registryRuleIds.size,
+        auto: registryAutoRuleIds.size,
+        declarative: registryDeclarativeRuleIds.size,
+      },
+      stageApplicableAutoRuleIds: [...stageApplicableAutoRuleIds].sort(),
+      declarativeRuleIds: [...registryDeclarativeRuleIds].sort(),
+      excludedDeclarativeReason:
+        'DECLARATIVE skills are registry contract/policy rules. They are not executed as PRE_COMMIT runtime detectors; only AUTO rules applicable to the current stage are evaluated.',
+    },
   };
 };

package/integrations/evidence/rulesCoverage.ts

@@ -34,6 +34,9 @@ export const createEmptySnapshotRulesCoverage = (
   stage: GateStage
 ): SnapshotRulesCoverage => ({
   stage,
+  contract: 'AUTO_RUNTIME_RULES_FOR_STAGE',
+  scope_note:
+    'No runtime rules were evaluated for this stage. DECLARATIVE registry rules are not runtime detectors.',
   active_rule_ids: [],
   evaluated_rule_ids: [],
   matched_rule_ids: [],
@@ -60,6 +63,11 @@ export const normalizeSnapshotRulesCoverage = (
   const matchedRuleIds = normalizeStringArray(value.matched_rule_ids);
   const unevaluatedRuleIds = normalizeStringArray(value.unevaluated_rule_ids);
   const unsupportedAutoRuleIds = normalizeStringArray(value.unsupported_auto_rule_ids ?? []);
+  const stageApplicableAutoRuleIds = normalizeStringArray(
+    value.stage_applicable_auto_rule_ids ?? []
+  );
+  const declarativeRuleIds = normalizeStringArray(value.declarative_rule_ids ?? []);
+  const registryTotals = value.registry_totals;
 
   const derivedCounts = {
     active: activeRuleIds.length,
@@ -83,6 +91,15 @@ export const normalizeSnapshotRulesCoverage = (
     ),
   };
 
+  if (registryTotals) {
+    counts.registry_total = normalizeCount(registryTotals.total);
+    counts.registry_auto = normalizeCount(registryTotals.auto);
+    counts.registry_declarative = normalizeCount(registryTotals.declarative);
+  }
+  if (stageApplicableAutoRuleIds.length > 0) {
+    counts.stage_applicable_auto = stageApplicableAutoRuleIds.length;
+  }
+
   if (unsupportedAutoCount > 0) {
     counts.unsupported_auto = unsupportedAutoCount;
   }
@@ -94,6 +111,10 @@ export const normalizeSnapshotRulesCoverage = (
 
   const normalized: SnapshotRulesCoverage = {
     stage,
+    contract: value.contract ?? 'AUTO_RUNTIME_RULES_FOR_STAGE',
+    scope_note:
+      value.scope_note ??
+      'rules_coverage reports AUTO runtime rules applicable to this stage, not total DECLARATIVE registry surface.',
     active_rule_ids: activeRuleIds,
     evaluated_rule_ids: evaluatedRuleIds,
     matched_rule_ids: matchedRuleIds,
@@ -102,6 +123,26 @@ export const normalizeSnapshotRulesCoverage = (
     coverage_ratio: coverageRatio,
   };
 
+  if (registryTotals) {
+    normalized.registry_totals = {
+      total: normalizeCount(registryTotals.total),
+      auto: normalizeCount(registryTotals.auto),
+      declarative: normalizeCount(registryTotals.declarative),
+    };
+  }
+
+  if (stageApplicableAutoRuleIds.length > 0) {
+    normalized.stage_applicable_auto_rule_ids = stageApplicableAutoRuleIds;
+  }
+
+  if (declarativeRuleIds.length > 0) {
+    normalized.declarative_rule_ids = declarativeRuleIds;
+  }
+
+  if (typeof value.declarative_excluded_reason === 'string') {
+    normalized.declarative_excluded_reason = value.declarative_excluded_reason;
+  }
+
   if (unsupportedAutoRuleIds.length > 0 || unsupportedAutoCount > 0) {
     normalized.unsupported_auto_rule_ids = unsupportedAutoRuleIds;
   }

package/integrations/evidence/schema.ts

@@ -47,16 +47,30 @@ export type SnapshotEvaluationMetrics = {
 
 export type SnapshotRulesCoverage = {
   stage: GateStage;
+  contract?: 'AUTO_RUNTIME_RULES_FOR_STAGE';
+  scope_note?: string;
   active_rule_ids: string[];
   evaluated_rule_ids: string[];
   matched_rule_ids: string[];
   unevaluated_rule_ids: string[];
   unsupported_auto_rule_ids?: string[];
+  registry_totals?: {
+    total: number;
+    auto: number;
+    declarative: number;
+  };
+  stage_applicable_auto_rule_ids?: string[];
+  declarative_rule_ids?: string[];
+  declarative_excluded_reason?: string;
   counts: {
     active: number;
     evaluated: number;
     matched: number;
     unevaluated: number;
+    registry_total?: number;
+    registry_auto?: number;
+    registry_declarative?: number;
+    stage_applicable_auto?: number;
     unsupported_auto?: number;
   };
   coverage_ratio: number;

package/integrations/git/runPlatformGate.ts

@@ -1115,10 +1115,24 @@ export async function runPlatformGate(params: {
   const rulesCoverage = coverage
     ? {
       stage: params.policy.stage,
+      contract: skillsRuleSet.registryCoverage?.contract ?? 'AUTO_RUNTIME_RULES_FOR_STAGE',
+      scope_note:
+        'rules_coverage reports AUTO runtime rules applicable to this stage; it does not claim full DECLARATIVE registry execution.',
       active_rule_ids: [...coverage.activeRuleIds],
       evaluated_rule_ids: [...coverage.evaluatedRuleIds],
       matched_rule_ids: [...coverage.matchedRuleIds],
       unevaluated_rule_ids: [...coverage.unevaluatedRuleIds],
+      ...(skillsRuleSet.registryCoverage
+        ? {
+          registry_totals: skillsRuleSet.registryCoverage.registryTotals,
+          stage_applicable_auto_rule_ids: [
+            ...skillsRuleSet.registryCoverage.stageApplicableAutoRuleIds,
+          ],
+          declarative_rule_ids: [...skillsRuleSet.registryCoverage.declarativeRuleIds],
+          declarative_excluded_reason:
+            skillsRuleSet.registryCoverage.excludedDeclarativeReason,
+        }
+        : {}),
       ...((skillsRuleSet.unsupportedAutoRuleIds?.length ?? 0) > 0
         ? {
           unsupported_auto_rule_ids: [...(skillsRuleSet.unsupportedAutoRuleIds ?? [])],
@@ -1129,6 +1143,16 @@ export async function runPlatformGate(params: {
         evaluated: coverage.evaluatedRuleIds.length,
         matched: coverage.matchedRuleIds.length,
         unevaluated: coverage.unevaluatedRuleIds.length,
+        ...(skillsRuleSet.registryCoverage
+          ? {
+            registry_total: skillsRuleSet.registryCoverage.registryTotals.total,
+            registry_auto: skillsRuleSet.registryCoverage.registryTotals.auto,
+            registry_declarative:
+              skillsRuleSet.registryCoverage.registryTotals.declarative,
+            stage_applicable_auto:
+              skillsRuleSet.registryCoverage.stageApplicableAutoRuleIds.length,
+          }
+          : {}),
         ...((skillsRuleSet.unsupportedAutoRuleIds?.length ?? 0) > 0
           ? {
             unsupported_auto: (skillsRuleSet.unsupportedAutoRuleIds ?? []).length,

package/integrations/lifecycle/audit.ts

@@ -1,5 +1,5 @@
 import { readEvidence } from '../evidence/readEvidence';
-import type { AiEvidenceV2_1, SnapshotFinding } from '../evidence/schema';
+import type { AiEvidenceV2_1, SnapshotFinding, SnapshotRulesCoverage } from '../evidence/schema';
 import { GitService, type IGitService } from '../git/GitService';
 import { hasAllowedExtension } from '../git/gitDiffUtils';
 import { runPlatformGate } from '../git/runPlatformGate';
@@ -31,6 +31,18 @@ export type LifecycleAuditResult = {
   snapshot_outcome: string | null;
   findings_count: number;
   blocking_findings_count: number;
+  rules_coverage: SnapshotRulesCoverage | null;
+  rule_id_normalization: {
+    contract: 'registry_or_declared_runtime_normalization';
+    registry_rule_ids_count: number;
+    finding_rule_ids_count: number;
+    entries: ReadonlyArray<{
+      runtime_rule_id: string;
+      registry_rule_id: string | null;
+      status: 'registry_1_to_1' | 'runtime_derived';
+      normalization: string;
+    }>;
+  };
   findings: ReadonlyArray<LifecycleAuditFinding>;
   policy_reconcile_hint: string;
 };
@@ -114,6 +126,39 @@ const extractAuditFindings = (params: {
   return [];
 };
 
+const buildRuleIdNormalization = (params: {
+  findings: ReadonlyArray<LifecycleAuditFinding>;
+  rulesCoverage: SnapshotRulesCoverage | undefined;
+}): LifecycleAuditResult['rule_id_normalization'] => {
+  const registryRuleIds = new Set([
+    ...(params.rulesCoverage?.stage_applicable_auto_rule_ids ?? []),
+    ...(params.rulesCoverage?.declarative_rule_ids ?? []),
+  ]);
+  const findingRuleIds = [...new Set(params.findings.map((finding) => finding.ruleId))].sort();
+  return {
+    contract: 'registry_or_declared_runtime_normalization',
+    registry_rule_ids_count: registryRuleIds.size,
+    finding_rule_ids_count: findingRuleIds.length,
+    entries: findingRuleIds.map((ruleId) => {
+      if (registryRuleIds.has(ruleId)) {
+        return {
+          runtime_rule_id: ruleId,
+          registry_rule_id: ruleId,
+          status: 'registry_1_to_1',
+          normalization: 'finding ruleId is an exact skills registry rule id',
+        };
+      }
+      return {
+        runtime_rule_id: ruleId,
+        registry_rule_id: null,
+        status: 'runtime_derived',
+        normalization:
+          'finding ruleId is emitted by baseline/runtime governance outside the skills registry; see rules_coverage for the AUTO skills scope evaluated at this stage',
+      };
+    }),
+  };
+};
+
 export const runLifecycleAudit = async (params: {
   stage: LifecycleAuditStage;
   auditMode: 'gate' | 'engine';
@@ -192,6 +237,11 @@ export const runLifecycleAudit = async (params: {
     snapshot_outcome: snapshotOutcome,
     findings_count: findings.length,
     blocking_findings_count: findings.filter((finding) => finding.blocking).length,
+    rules_coverage: evidence?.snapshot.rules_coverage ?? null,
+    rule_id_normalization: buildRuleIdNormalization({
+      findings,
+      rulesCoverage: evidence?.snapshot.rules_coverage,
+    }),
     findings,
     policy_reconcile_hint: POLICY_RECONCILE_HINT,
   };

package/integrations/lifecycle/cli.ts

@@ -1755,7 +1755,7 @@ const buildAnalyticsExperimentalDisabledEnvelope = (
   result: {
     code: 'ANALYTICS_EXPERIMENTAL_DISABLED',
     message:
-      'Analytics hotspots pertenece al namespace experimental y está desactivado por defecto. Actívalo explícitamente con PUMUKI_EXPERIMENTAL_ANALYTICS=advisory o strict si necesitas este flujo.',
+      'Analytics hotspots está desactivado explícitamente. Usa PUMUKI_EXPERIMENTAL_ANALYTICS=advisory o strict si necesitas este flujo.',
     experimental_feature: 'analytics',
     mode: feature.mode,
     source: feature.source,
@@ -1777,7 +1777,7 @@ const buildSaasIngestionExperimentalDisabledEnvelope = (
   result: {
     code: 'SAAS_INGESTION_EXPERIMENTAL_DISABLED',
     message:
-      'SaaS ingestion/federation pertenece al namespace experimental y está desactivado por defecto. Actívalo explícitamente con PUMUKI_EXPERIMENTAL_SAAS_INGESTION=advisory o strict si necesitas este flujo.',
+      'SaaS ingestion/federation está desactivado explícitamente. Usa PUMUKI_EXPERIMENTAL_SAAS_INGESTION=advisory o strict si necesitas este flujo.',
     experimental_feature: 'saas_ingestion',
     mode: feature.mode,
     source: feature.source,
@@ -1799,7 +1799,7 @@ export const buildPreWriteExperimentalDisabledResult = (params: {
     allowed: true,
     code: 'PRE_WRITE_EXPERIMENTAL_DISABLED',
     message:
-      'PRE_WRITE pertenece al namespace experimental y está desactivado por defecto. Actívalo explícitamente con PUMUKI_EXPERIMENTAL_PRE_WRITE=advisory o strict si necesitas este flujo.',
+      'PRE_WRITE está desactivado explícitamente. Usa PUMUKI_EXPERIMENTAL_PRE_WRITE=advisory o strict si necesitas este flujo.',
     details: {
       experimental: true,
       default_off: true,

package/integrations/lifecycle/cliSdd.ts

@@ -102,7 +102,7 @@ export const runSddCommand = async (parsed: ParsedArgs, activeDependencies: Life
                       attempted: false,
                       status: 'SKIPPED',
                       actions: [],
-                      details: 'PRE_WRITE experimental/default-off.',
+                      details: 'PRE_WRITE experimental/off-by-env.',
                     },
                     next_action: {
                       reason: 'PRE_WRITE_EXPERIMENTAL_DISABLED',

package/integrations/mcp/enterpriseServer.ts

@@ -821,11 +821,11 @@ export const startEnterpriseMcpServer = (
               dryRun: true,
               executed: false,
               success: false,
-              warnings: ['Enterprise MCP está desactivado por defecto en el baseline del reset.'],
+              warnings: ['Enterprise MCP está desactivado explícitamente por configuración.'],
               result: {
                 code: 'MCP_ENTERPRISE_EXPERIMENTAL_DISABLED',
                 message:
-                  'MCP enterprise pertenece al namespace experimental y está desactivado por defecto.',
+                  'MCP enterprise está desactivado explícitamente por configuración.',
                 experimental_feature: experimentalFeature.feature,
                 mode: experimentalFeature.mode,
                 source: experimentalFeature.source,

package/integrations/policy/experimentalFeatures.ts

@@ -45,12 +45,12 @@ const EXPERIMENTAL_FEATURES: Record<ExperimentalFeatureId, ExperimentalFeatureCo
     legacyActivationVariable: 'PUMUKI_PREWRITE_ENFORCEMENT',
   },
   sdd: {
-    defaultMode: 'off',
+    defaultMode: 'strict',
     activationVariable: 'PUMUKI_EXPERIMENTAL_SDD',
     legacyActivationVariable: null,
   },
   heuristics: {
-    defaultMode: 'off',
+    defaultMode: 'strict',
     activationVariable: 'PUMUKI_EXPERIMENTAL_HEURISTICS',
     legacyActivationVariable: null,
   },
@@ -60,22 +60,22 @@ const EXPERIMENTAL_FEATURES: Record<ExperimentalFeatureId, ExperimentalFeatureCo
     legacyActivationVariable: null,
   },
   learning_context: {
-    defaultMode: 'off',
+    defaultMode: 'strict',
     activationVariable: 'PUMUKI_EXPERIMENTAL_LEARNING_CONTEXT',
     legacyActivationVariable: null,
   },
   analytics: {
-    defaultMode: 'off',
+    defaultMode: 'strict',
     activationVariable: 'PUMUKI_EXPERIMENTAL_ANALYTICS',
     legacyActivationVariable: null,
   },
   operational_memory: {
-    defaultMode: 'off',
+    defaultMode: 'strict',
     activationVariable: 'PUMUKI_EXPERIMENTAL_OPERATIONAL_MEMORY',
     legacyActivationVariable: null,
   },
   saas_ingestion: {
-    defaultMode: 'off',
+    defaultMode: 'strict',
     activationVariable: 'PUMUKI_EXPERIMENTAL_SAAS_INGESTION',
     legacyActivationVariable: null,
   },

package/integrations/sdd/policy.ts

@@ -326,7 +326,7 @@ export const evaluateSddPolicy = (params: {
         allowed: true,
         code: 'SDD_EXPERIMENTAL_DISABLED',
         message:
-          'SDD/OpenSpec pertenece al namespace experimental y está desactivado por defecto. Actívalo explícitamente con PUMUKI_EXPERIMENTAL_SDD=advisory o strict si necesitas este flujo.',
+          'SDD/OpenSpec está desactivado explícitamente. Usa PUMUKI_EXPERIMENTAL_SDD=advisory o strict si necesitas este flujo.',
         details: {
           experimental: true,
           default_off: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pumuki",
-  "version": "6.3.126",
+  "version": "6.3.128",
   "description": "Enterprise-grade AST Intelligence System with multi-platform support (iOS, Android, Backend, Frontend) and Feature-First + DDD + Clean Architecture enforcement. Includes dynamic violations API for intelligent querying.",
   "main": "index.js",
   "bin": {

package/scripts/framework-menu-consumer-actions-lib.ts

@@ -61,7 +61,7 @@ export const createConsumerLegacyMenuActions = (
     },
     {
       id: '14',
-      label: 'Engine audit · FULL tracked repo (no preflight · PRE_COMMIT)',
+      label: 'Engine audit · tracked repo files (AUTO runtime rules · PRE_COMMIT)',
       execute: params.runEngineFullRepoNoPreflight,
     },
     {