specky-sdd 3.10.2 → 3.11.1

package/CHANGELOG.md

@@ -7,6 +7,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.11.1] - 2026-07-16
+
+### Added
+
+- Signed per-feature use-case contracts for the 54 supported lifecycle, workload, and execution-mode combinations.
+- Central execution-context resolution and contract enforcement for the MCP tool surface.
+- `specky migrate-contracts` for explicit migration of legacy root state to signed v5 per-feature state.
+- Contract-aware pipeline profiles, strict capability configuration, explicit evidence payloads, and atomic multi-file writes.
+
+### Changed
+
+- Documentation, diagrams, research, and turnkey specification tools now consume caller-supplied evidence and contract configuration instead of synthesizing unspecified content.
+- Agents, prompts, skills, hooks, installer output, generated API reference, and public site content describe the signed per-feature contract model.
+- Build output is cleaned before compilation so deleted source modules cannot remain in the npm tarball.
+
+### Fixed
+
+- Cursor plugin creation now avoids the previously identified TOCTOU path race and removes unsafe `any` usage.
+- APM primitive lock material is regenerated for the current canonical assets.
+
+### Security
+
+- Feature-scoped MCP tools reject ambiguous, legacy, missing, or mismatched execution context rather than selecting a feature implicitly.
+
+## [3.11.0] - 2026-07-13
+
+### Added
+
+- Canonical agent `capabilities:` declarations compiled into target-native tool identifiers for Copilot, Claude Code, Cursor, and OpenCode.
+- `--permission-profile=scoped|prompt` installation modes. The scoped Claude profile derives narrow native, command, and MCP allow rules from installed agent capabilities.
+- Optional GitHub MCP registration with `--integration=github`, including target-aware diagnostics in `specky doctor`.
+- [Target Capabilities](docs/TARGET-CAPABILITIES.md) reference for target rendering, approval boundaries, and GitHub MCP routing.
+
+### Changed
+
+- Initializer, orchestrator, verifier, implementer, and release workflows now declare the Git/test/release capabilities their instructions require.
+- Release workflows distinguish Specky payload generation from authenticated GitHub MCP mutations.
+- APM runtime references are pinned to the package release version rather than `@latest`.
+
 ## [3.10.2] - 2026-07-13
 
 Patch release: Specky logo in VS Code and Cursor MCP / Agent Plugins UI.

package/README.md

@@ -2,13 +2,13 @@
   <br>
   <img src="site/specky-brand-logo.svg" alt="Specky" height="80">
   <br><br>
-  <p><strong>13 agents. 58 MCP tools. 10-phase pipeline. One CLI.</strong></p>
+  <p><strong>13 agents. 58 MCP tools. Explicit use-case contracts. One CLI.</strong></p>
   <p>Agentic Spec-Driven Development</p>
 
   <p>
     <img src="https://img.shields.io/badge/agents-13-374151?style=flat-square" alt="13 Agents"/>
     <img src="https://img.shields.io/badge/tools-58_MCP-4b5563?style=flat-square" alt="58 Tools"/>
-    <img src="https://img.shields.io/badge/phases-10_enforced-6b7280?style=flat-square" alt="10 Phases"/>
+    <img src="https://img.shields.io/badge/phase_graphs-contract_scoped-6b7280?style=flat-square" alt="Contract-scoped phase graphs"/>
     <img src="https://img.shields.io/badge/hooks-16-9ca3af?style=flat-square" alt="16 Hooks"/>
     <img src="https://img.shields.io/badge/license-MIT-d1d5db?style=flat-square" alt="MIT"/>
   </p>
@@ -33,6 +33,7 @@
   <p>
     <a href="https://getspecky.ai">Website</a> ·
     <a href="docs/GETTING-STARTED.md">Getting Started</a> ·
+    <a href="docs/USE-CASE-CONTRACTS.md">Use-Case Contracts</a> ·
     <a href="https://www.npmjs.com/package/specky-sdd">npm</a> ·
     <a href="SECURITY.md">Security</a>
   </p>
@@ -50,19 +51,20 @@
 | | [Where Specifications Live](#where-specifications-live) | File structure and naming conventions |
 | | [Input Methods](#input-methods-6-ways-to-start) | 6 ways to feed Specky |
 | | [Three Project Types](#three-project-types-one-pipeline) | Greenfield, Brownfield, Modernization |
+| | [Use-Case Contracts](docs/USE-CASE-CONTRACTS.md) | Lifecycle, workload, mode, capabilities, evidence, migration |
 | | [How to upgrade](#how-to-upgrade) | Bump npm + refresh project assets (no `--target` needed) |
 | | [Staying up to date](#staying-up-to-date) | Update notifications and opt-out |
-| **Pipeline** | [Pipeline and LGTM Gates](#pipeline-and-lgtm-gates) | 10 phases with human review gates |
+| **Pipeline** | [Pipeline and LGTM Gates](#pipeline-and-lgtm-gates) | Feature-specific phase graphs and configured review gates |
 | | [All 58 Tools](#all-58-tools) | Complete tool reference by category |
 | | [EARS Notation](#ears-notation) | The 6 requirement patterns |
 | **Enterprise** | [Compliance Frameworks](#compliance-frameworks) | HIPAA, SOC2, GDPR, PCI-DSS, ISO 27001 |
 | | [Enterprise Ready](#enterprise-ready) | Security, audit trail, quality gates |
 | **Platform** | [The SDD Platform](#the-spec-driven-development-platform) | Built on Spec-Kit, everything included |
-| | [Roadmap](#roadmap) | v3.10 current, v3.11+ planned |
+| | [Roadmap](#roadmap) | v3.11.1 current, future capabilities planned |
 
 ## What is Specky?
 
-Specky is a **CLI toolkit for Spec-Driven Development** — 13 specialized agents, 58 MCP tools, 22 prompts, 14 skills, and 16 automation hooks — that enforces a deterministic 10-phase pipeline from **any input** (meeting transcripts, documents, Figma designs, or natural language prompts) through specifications, architecture, infrastructure as code, implementation, and deployment.
+Specky is a **CLI toolkit for Spec-Driven Development** — 13 specialized agents, 58 MCP tools, 22 prompts, 14 skills, and 16 automation hooks. Each feature selects an explicit lifecycle, workload, execution mode, and capability configuration; Specky persists the resolved phase graph and rejects missing identity, hidden defaults, unsupported capabilities, and ungrounded artifact evidence.
 
 Powered by the [Spec-Kit](https://github.com/paulasilvatech/spec-kit) methodology. Install the `specky` CLI and it places agents, prompts, skills, hooks, and the MCP server registration into your project — for **GitHub Copilot** (VS Code), **Claude Code**, **Cursor**, or **OpenCode**.
 
@@ -82,8 +84,8 @@ Specky is a **complete AI development toolkit** — not just an MCP server. The
 
 An MCP server gives you **tools**. The CLI toolkit gives you the **experience**:
 
-- **Tools alone**: You call `sdd_write_spec` and hope you're in the right phase, with the right prerequisites, on the right branch.
-- **CLI toolkit**: You type `@specky-orchestrator` and the agent validates your phase, checks your branch, loads the right skill, calls the right tool, runs pre/post hooks, and pauses for LGTM before advancing.
+- **Tools alone**: You must provide exact feature identity, use-case selection, capability parameters, and evidence.
+- **CLI toolkit**: You invoke `@specky-orchestrator`; it loads the feature's signed contract, follows its persisted graph, delegates to lean agents that read rich skills, and applies configured gates.
 
 The MCP engine is the runtime. The agents + hooks + skills are the product.
 
@@ -101,7 +103,7 @@ specky install --target=copilot      # VS Code + GitHub Copilot (recommended)
 specky install --target=claude       # Claude Code
 specky install --target=cursor       # Cursor
 specky install --target=opencode     # OpenCode
-specky install --target=agent-skills # Shared .agents/skills bundle
+specky install --target=agent-skills # Skills-only shared .agents/skills bundle
 ```
 
 > **Important:** Prefer `--target=...`. The legacy `--ide` flag still works for `copilot`, `claude`, `both`, and `auto`, but it is deprecated in favor of APM-style targets. If Copilot is installed in a workspace, Specky strips Claude hooks from `.claude/settings.json` to prevent Copilot cross-read blocks. See [docs/INSTALL.md](docs/INSTALL.md) for details.
@@ -114,9 +116,9 @@ npm install --save-dev specky-sdd@latest
 npx specky install --target=copilot
 ```
 
-The CLI installs 13 agents, 22 prompts, 14 skills, 16 hooks, the target MCP server registration (pinned to the installed version), and pre-authorizes or scopes tools according to the selected harness. It does **not** pre-authorize arbitrary shell, `rm`, or network access; those still prompt. Run `specky doctor` anytime to validate integrity and config.
+The CLI installs 13 agents, 22 prompts, 14 skills, 16 hooks, and target-local MCP registration pinned to the installed version. Canonical agent capabilities compile to the selected harness's native tools; they are not inferred from workflow prose. Use `--permission-profile=scoped` (default) for narrow Claude pre-authorization, or `--permission-profile=prompt` to leave every approval with the host. Specky does **not** pre-authorize arbitrary shell, `rm`, network access, or credentials. Add `--integration=github` only when GitHub MCP routing is required. Run `specky doctor` anytime to validate integrity and configuration.
 
-Generated assets are platform-native. `specky install --target=copilot` writes GitHub Copilot agents/prompts with VS Code tool names such as `search`, `agent`, and `specky/sdd_get_status`, plus prompt `agent: agent` frontmatter. `specky install --target=claude` writes Claude Code agents/commands with `Read`, `Glob`, `Grep`, `Task`, and `mcp__specky__sdd_get_status`, with Copilot-only prompt metadata removed. Wave 1 APM targets also include Cursor, OpenCode, and the neutral `agent-skills` target.
+Generated assets are platform-native. `specky install --target=copilot` writes GitHub Copilot agents/prompts with VS Code tool names such as `search`, `agent`, and `specky/sdd_get_status`, plus prompt `agent: agent` frontmatter. `specky install --target=claude` writes Claude Code agents/commands with `Read`, `Glob`, `Grep`, `Task`, and `mcp__specky__sdd_get_status`, with Copilot-only prompt metadata removed. Cursor and OpenCode receive their own native vocabulary. `agent-skills` is intentionally skills-only. See [Target Capabilities](docs/TARGET-CAPABILITIES.md) for the full capability matrix, GitHub MCP opt-in, and host approval boundaries.
 
 Specky also has an APM governance layer for enterprise package control. `apm.yml` declares the package primitives, targets, and MCP runtime; `apm.lock.yaml` pins primitive hashes; `apm-policy.yml` enforces MCP and tool-name policy. Maintainers and CI can run `specky apm validate`, `specky apm policy`, `specky apm verify-lock`, and `specky apm sbom` before publishing or installing. See [Uso do APM pelo Specky](docs/APM-USAGE.md) for the detailed model, including why APM is not a runtime proxy and why users do not need to install the Microsoft APM CLI.
 
@@ -175,7 +177,7 @@ flowchart LR
 
 AI coding assistants are fast but chaotic. You say *"build me a login system"* and the AI generates code immediately, skipping requirements, guessing architecture, and producing something that works but doesn't match what anyone actually needed. This is **vibe coding**: generating code based on vibes instead of validated specifications.
 
-The result? Teams spend 40% of their time on rework because requirements were never written down, acceptance criteria were never defined, and there's no way to verify the code matches the original intent.
+The result is avoidable rework: requirements, acceptance criteria, design decisions, tasks, tests, and release evidence cannot be traced to one reviewed contract.
 
 ### The Solution: Deterministic Development
 
@@ -195,7 +197,7 @@ The result? Teams spend 40% of their time on rework because requirements were ne
 
 Specky adds a **deterministic engine** between your intent and your code:
 
-- **State Machine**: 10 mandatory phases, no skipping. Init, Discover, Specify, Clarify, Design, Tasks, Analyze, Implement, Verify, Release.
+- **State Machine**: signed per-feature phase graphs for full, rapid, and emergency execution modes.
 - **EARS Validator**: Every requirement validated against 6 patterns. No vague statements pass.
 - **Cross-Artifact Analysis**: Automatic alignment checking between spec, design, and tasks. Orphaned requirements are flagged instantly.
 - **MCP-to-MCP Architecture**: Specky outputs structured JSON that your AI client routes to GitHub, Azure DevOps, Jira, Terraform, Figma, and Docker MCP servers. No vendor lock-in.
@@ -207,18 +209,18 @@ Specky adds a **deterministic engine** between your intent and your code:
 | Capability | Specky |
 |---|---|
 | Complete CLI toolkit | 13 agents, 22 prompts, 14 skills, 16 hooks + 58 MCP tools |
-| Pipeline orchestrator | @specky-orchestrator coordinates all 10 phases end-to-end |
+| Pipeline orchestrator | @specky-orchestrator follows the selected feature's signed phase graph |
 | Onboarding wizard | @specky-onboarding detects context and guides setup |
-| Any input (PDF, DOCX, PPTX, transcript, Figma) to spec | 58 MCP tools handle all input formats |
+| Explicit input contracts | Document, transcript, and Figma tools require enabled capabilities and complete parameters |
 | EARS validation (programmatic, not AI guessing) | 6 patterns enforced at schema level |
-| Enforced pipeline (not suggestions) | 10 phases with actual gates that block advancement |
+| Enforced pipeline (not suggestions) | Contract-specific phases, central analysis gate, optional configured LGTM blocking |
 | Pre/post hooks on every phase | specky-artifact-validator, specky-branch-validator, specky-phase-gate, specky-lgtm-gate |
-| 17 diagram types generated automatically | C4 (4 levels), sequence, ER, activity, use case, DFD, deployment, network |
-| Infrastructure as Code | Terraform, Bicep, Dockerfile from DESIGN.md |
+| Workload-specific diagrams | Exact required manifest, explicit Mermaid/FigJam payloads, source evidence references |
+| Infrastructure as Code | Terraform from persisted cloud/resources; DESIGN.md evidence required |
 | Work item export | GitHub Issues, Azure Boards, Jira via MCP-to-MCP routing |
-| 6 compliance frameworks | HIPAA, SOC2, GDPR, PCI-DSS, ISO 27001 built-in |
+| 5 compliance frameworks | HIPAA, SOC2, GDPR, PCI-DSS, ISO 27001 with explicit control-ID evidence |
 | Cross-artifact traceability | Requirement to design to task to test to code |
-| Gitflow-SDD branching | spec/NNN → develop → stage → main |
+| Explicit release policy | Branch prefix, base, draft, and checkpoint choices persisted per feature |
 | Unified CLI distribution | `npm install -g specky-sdd && specky install --target=copilot` — one binary, multi-OS (macOS/Linux/Windows/WSL) |
 | First-class harness targets | VS Code + Copilot, Claude Code, Cursor, OpenCode, plus shared `.agents/skills` |
 | Zero outbound calls from the MCP server | Air-gap friendly; code never leaves your machine. The CLI's once-daily update check is [opt-out](#staying-up-to-date) |
@@ -284,7 +286,7 @@ The onboarding wizard detects your project context (greenfield/brownfield/modern
 @specky-orchestrator run the pipeline for a todo API
 ```
 
-The orchestrator coordinates all 10 phases: Init → Discover → Specify → Clarify → Design → Tasks → Analyze → Implement → Verify → Release, with LGTM gates at Specify, Design, and Tasks.
+The orchestrator resolves the selected feature contract and follows its `full`, `rapid`, or `emergency` phase graph. Specify, Design, and Tasks require `lgtm: true` only when workspace configuration enables LGTM enforcement.
 
 | Your situation | Guide |
 |---------------|-------|
@@ -557,26 +559,26 @@ The AI calls `sdd_write_tasks` → creates `TASKS.md` with implementation tasks
 ### Step 5: Quality gates
 
 ```
-> Run analysis, compliance check for SOC2, and generate all diagrams
+> Run analysis, submit SOC2 control evidence, and validate the workload-required diagram set
 ```
 
 The AI calls:
 
 - `sdd_run_analysis` → completeness audit, orphaned criteria detection
-- `sdd_compliance_check` → SOC2 controls validation
-- `sdd_generate_all_diagrams` → architecture, sequence, ER, flow, dependency, traceability diagrams
+- `sdd_compliance_check` → evaluates the persisted SOC2 pack using evidence keyed by control ID
+- `sdd_generate_all_diagrams` → validates exactly the workload-required Mermaid payloads against source evidence
 
 ### Step 6: Generate infrastructure and tests
 
 ```
-> Generate Terraform for Azure, a Dockerfile, and test stubs for vitest
+> Generate the persisted Azure Terraform resources, Docker environment, and executable Vitest bindings
 ```
 
 The AI calls:
 
-- `sdd_generate_iac` → Terraform configuration
-- `sdd_generate_dockerfile` → Dockerfile + docker-compose
-- `sdd_generate_tests` → Test stubs with acceptance criteria mapped to test cases
+- `sdd_generate_iac` → Terraform for the exact cloud/resources stored in the feature contract
+- `sdd_generate_dockerfile` → Dockerfile/compose from the persisted development stack
+- `sdd_generate_tests` → executable tests from fingerprinted requirement bindings
 
 ### Step 7: Export and ship
 
@@ -758,9 +760,9 @@ flowchart LR
   class G1,G2,G3 gate;
 ```
 
-Every Specky project follows the same 10-phase pipeline. The state machine **blocks phase-skipping**. You cannot jump from Init to Design without completing Specify first.
+This diagram is the `full` execution-mode graph. Rapid and emergency contracts persist smaller ordered graphs. The state machine blocks transitions outside the selected feature's graph.
 
-**LGTM gates:** After each major phase (Specify, Design, Tasks), the AI pauses and asks you to review. Reply **LGTM** to proceed. This ensures human oversight at every quality gate.
+**LGTM gates:** Specify, Design, and Tasks can require `lgtm: true` when `.specky/config.yml` enables LGTM enforcement. When disabled, review remains useful but is not a hidden blocking default.
 
 **Feedback loop:** If `sdd_verify_tasks` detects drift between specification and implementation, Specky routes you back to the Specify phase to correct the divergence before proceeding.
 
@@ -833,13 +835,13 @@ All artifacts are saved in [`.specs/NNN-feature/`](#where-specifications-live).
 | `sdd_validate_ears` | Batch EARS requirement validation |
 | `sdd_check_sync` | Spec-vs-implementation drift detection report |
 
-### Diagrams and Visualization (4) -- 17 Diagram Types
+### Diagrams and Visualization (4) — Workload-Contracted Payloads
 
 | Tool | Description |
 |------|-------------|
-| `sdd_generate_diagram` | Single Mermaid diagram (17 software engineering diagram types) |
-| `sdd_generate_all_diagrams` | All diagrams for a feature at once |
-| `sdd_generate_user_stories` | User stories with flow diagrams |
+| `sdd_generate_diagram` | Single Mermaid diagram validated against the workload contract's required set |
+| `sdd_generate_all_diagrams` | The exact diagram set the feature contract requires, written atomically |
+| `sdd_generate_user_stories` | User stories with flow diagrams (web-application workload) |
 | `sdd_figma_diagram` | FigJam-ready diagram via Figma MCP |
 
 ### Infrastructure as Code (3)
@@ -893,15 +895,15 @@ All artifacts are saved in [`.specs/NNN-feature/`](#where-specifications-live).
 
 | Tool | Description |
 |------|-------------|
-| `sdd_generate_tests` | Generate test stubs from acceptance criteria (vitest/jest/playwright/pytest/junit/xunit) |
+| `sdd_generate_tests` | Assemble executable tests from persisted requirement bindings (vitest/jest/playwright/pytest/junit/xunit) |
 | `sdd_verify_tests` | Verify test results against requirements, report traceability coverage |
-| `sdd_generate_pbt` | Generate property-based tests using fast-check (TypeScript) or Hypothesis (Python). Extracts invariants, round-trips, idempotence, state transitions, and negative properties from EARS requirements |
+| `sdd_generate_pbt` | Assemble executable fast-check or Hypothesis properties from persisted requirement bindings; no generated model stubs |
 
 ### Turnkey Specification (1)
 
 | Tool | Description |
 |------|-------------|
-| `sdd_turnkey_spec` | Generate a complete EARS specification from a natural language description. Auto-extracts requirements, classifies all 6 EARS patterns, generates acceptance criteria, infers non-functional requirements, and identifies clarification questions |
+| `sdd_turnkey_spec` | Assemble caller-authored EARS requirements, criteria, evidence, discovery context, and clarification responses for an initialized feature; never infers requirements or creates state |
 
 ### Checkpointing (3)
 
@@ -921,7 +923,7 @@ All artifacts are saved in [`.specs/NNN-feature/`](#where-specifications-live).
 
 | Tool | Description |
 |------|-------------|
-| `sdd_model_routing` | Model routing decision table for all 10 phases with cost analysis |
+| `sdd_model_routing` | Capability-class routing guidance for the phase vocabulary; the selected feature graph controls applicable phases |
 | `sdd_context_status` | Context tier assignment (Hot/Domain/Cold) for spec artifacts with token savings |
 | `sdd_check_access` | RBAC access check for current role with per-tool permissions summary |
 
@@ -1161,7 +1163,7 @@ Specky is 100% open source (MIT) — enterprise mode is just an opt-in configura
 
 - **3 runtime dependencies** — minimal attack surface (`@modelcontextprotocol/sdk`, `zod`, `yaml`)
 - **Zero outbound network requests from the MCP server** — all data stays local; the CLI's optional once-daily update check is the only network touch ([opt-out](#staying-up-to-date))
-- **No `eval()` or dynamic code execution** — template rendering is string replacement only
+- **Strict template rendering** — missing variables/loops raise `TemplateRenderError`; no TODO substitution or dynamic template execution
 - **Path traversal prevention**: FileManager sanitizes all paths, blocks `..` sequences
 - **Zod `.strict()` validation** — every tool input is schema-validated; unknown fields rejected
 - **specky-security-scan hook** blocks commits containing hardcoded secrets (exit code 2)
@@ -1183,7 +1185,7 @@ When using Specky, follow these practices to protect your data:
 | **Never expose HTTP mode to public networks without TLS** | HTTP has optional bearer-token auth but no TLS | `--http` binds to `127.0.0.1` by default; set `SDD_HTTP_TOKEN` (shared) or `SDD_HTTP_TOKENS_FILE` (per-user identity + role) for bearer auth. For remote access, add a reverse proxy (nginx, Caddy) terminating TLS |
 | **Protect the `.specs/` directory** | Contains your specification artifacts (architecture, API contracts, business logic) | Add `.specs/` to `.gitignore` if specs contain sensitive IP, or use a private repo |
 | **Protect checkpoints** | `.specs/{feature}/.checkpoints/` stores full artifact snapshots | Same as above — treat checkpoints like source code |
-| **Review auto-generated specs before committing** | Turnkey and auto-pipeline generate from natural language — may capture sensitive details | Review SPECIFICATION.md and DESIGN.md before `git add` |
+| **Review source-backed artifacts before committing** | Transcript/document inputs and explicit source quotes may contain sensitive details | Review SPECIFICATION.md, DESIGN.md, and TRANSCRIPT.md before `git add` |
 | **Keep the specky-security-scan hook enabled** | Detects API keys, passwords, tokens in staged files | Comes pre-configured; don't disable `.claude/hooks/specky-security-scan.sh` |
 | **Use environment variables for secrets** | Specky never stores credentials, but your specs might reference them | Write `$DATABASE_URL` in specs, never the actual connection string |
 | **Run `npm audit` regularly** | Catches dependency vulnerabilities | `npm audit` — CI runs this automatically on every PR |
@@ -1253,9 +1255,9 @@ npm run dev
 echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}' | node dist/index.js 2>/dev/null
 
 # Run the published image from GHCR (multi-arch: linux/amd64 + linux/arm64)
-docker pull ghcr.io/paulasilvatech/specky:latest        # or pin a release: :3.10.2
+docker pull ghcr.io/paulasilvatech/specky:latest        # or pin a release: :3.11.1
 docker run --rm -p 3200:3200 ghcr.io/paulasilvatech/specky:latest
-curl http://localhost:3200/health                       # -> {"status":"ok","version":"3.10.2"}
+curl http://localhost:3200/health                       # -> {"status":"ok","version":"3.11.1"}
 
 # Or build and run locally from source
 docker build -t specky-sdd:dev .
@@ -1270,20 +1272,20 @@ deployments (enterprise profile, token auth, TLS proxy, private packages) see
 
 ## Roadmap
 
-### v3.10 (current)
+### v3.11.1 (current)
 
 | Capability | Status |
 |------------|--------|
-| 58 MCP tools across 10 enforced pipeline phases | Stable |
+| 58 MCP tools driven by signed per-feature use-case contracts | Stable |
 | Unified `specky` CLI: install, doctor, status, upgrade, hooks, serve | Stable |
 | Target-specific install: `--target=copilot`, `claude`, `cursor`, `opencode`, or `agent-skills` | Stable |
 | Copilot-safe hook manifests (no lifecycle event cross-read) | Stable |
 | Phase validation on every tool with gate enforcement | Stable |
-| 17 software engineering diagram types (C4, sequence, ER, DFD, deployment, network) | Stable |
+| Workload-contracted diagram sets (C4, sequence, ER, DFD, deployment, network) | Stable |
 | 12-section system design template (C4 model, security, infrastructure) | Stable |
 | Enriched interactive responses on all tools (progress, handoff, education) | Stable |
 | Parallel documentation generation (5 types via Promise.all) | Stable |
-| Turnkey spec from natural language (`sdd_turnkey_spec`) | Stable |
+| Explicit turnkey specification assembly (`sdd_turnkey_spec`) | Stable |
 | Property-based testing with fast-check and Hypothesis (`sdd_generate_pbt`) | Stable |
 | Checkpoint/restore for spec artifacts | Stable |
 | Intelligence layer: model routing hints on all tools | Stable |
@@ -1293,7 +1295,7 @@ deployments (enterprise profile, token auth, TLS proxy, private packages) see
 | Intent drift detection with amendment suggestions | Stable |
 | 16 automation hooks (advisory-default, strict opt-in via SPECKY_GUARD) | Stable |
 | 13 specialized agents + 22 prompts + 14 skills | Stable |
-| 6 compliance frameworks (HIPAA, SOC2, GDPR, PCI-DSS, ISO 27001) | Stable |
+| 5 compliance frameworks (HIPAA, SOC2, GDPR, PCI-DSS, ISO 27001) with explicit control evidence | Stable |
 | 6 input types (transcript, PDF, DOCX, Figma, codebase, raw text) | Stable |
 | Test generation for 6 frameworks (vitest, jest, playwright, pytest, junit, xunit) | Stable |
 | MCP-to-MCP routing (GitHub, Azure DevOps, Jira, Terraform, Figma, Docker) | Stable |
@@ -1312,7 +1314,7 @@ deployments (enterprise profile, token auth, TLS proxy, private packages) see
 | OpenCode two-step bootstrap (`install` + `compile`) | Stable |
 | VS Code MCP dual schema (`servers` + `mcpServers`) | Stable |
 
-### v3.11+ (planned)
+### Future capabilities (planned)
 
 | Feature | Description |
 |---------|-------------|

package/SECURITY.md

@@ -46,6 +46,10 @@ AI Client → JSON-RPC → Zod .strict() validation → Service layer
 
 Specky does **not** use `eval()`, `Function()`, `vm.runInNewContext()`, or any dynamic code execution. Template rendering uses string replacement only — no template engines that execute code.
 
+### Agent Capability Boundaries
+
+The Specky MCP server does not execute arbitrary shell commands or persist GitHub credentials. Generated agents may declare narrowly scoped Git, test, or release-gate capabilities, but the selected host runtime executes and approves those native tools. The optional GitHub MCP integration is registered only with `specky install --integration=github`; GitHub authentication and repository authorization remain with the signed-in host identity. See [Target Capabilities](docs/TARGET-CAPABILITIES.md).
+
 ### Network Calls
 
 The **MCP server makes zero outbound network calls**. All data stays on the user's machine. It communicates only via stdio (JSON-RPC over stdin/stdout) or optional HTTP transport on localhost, and this holds unconditionally — `specky serve` never performs the update check described below.
@@ -127,7 +131,7 @@ The audit trail's plain hash chain detects corruption but not deliberate rewriti
 - Zero `any` types in source code — enforced by CI
 - All schemas use `.strict()` — rejects unknown fields
 - `FileManager` is the sole I/O boundary — no direct `fs` calls in tools or other services
-- No shell command execution — branch names and PR payloads are data only, not executed
+- The Specky MCP server does not execute shell commands; target runtimes may execute only the explicitly declared, host-approved agent capabilities
 
 ## Security Best Practices for Users
 

package/apm-policy.yml

@@ -16,6 +16,8 @@ mcp:
   allowTransitive: false
   allowedServers:
     - specky
+  optionalCapabilityServers:
+    - github
 
 # Hook governance. Hook manifests may only register these event types.
 hooks:

package/apm.lock.yaml

@@ -2,45 +2,47 @@
 schemaVersion: 1
 package:
   name: specky-sdd
-  version: 3.10.2
+  version: 3.11.1
 primitives:
-  .apm/agents/specky-design-architect.agent.md: sha256:a9411a98bd2fe4c4aa1e6eab66e84eaf9a010897d408e1737a279fe58f7023b2
-  .apm/agents/specky-implementer.agent.md: sha256:76c546fe70fe3f5399ba25f0e6de3d9b280880fe7c12d88f093cee55c0b02ece
-  .apm/agents/specky-onboarding.agent.md: sha256:755a51c27eb1fe044ce4940fe6dda3a8eb0ff983c04d1c00e1d59be59723aa9d
-  .apm/agents/specky-orchestrator.agent.md: sha256:aae379a2dd8833fc9861ee9302f244032856a739b3fb31f568713f866a16f0c8
-  .apm/agents/specky-quality-reviewer.agent.md: sha256:cdcbe7bee2a4c669b52b8a67d5f31bc01ea0b518ca6daabf57a4603af2312c83
-  .apm/agents/specky-release-engineer.agent.md: sha256:b33e0f64b6fe23fb427c9368945d76e780aff1d8d848ab67bbcb2fa1a03f50e9
-  .apm/agents/specky-requirements-engineer.agent.md: sha256:69f84bf9a9f7d76475f7a21e9067c906b73c2a867db9fefe50abee2a4942b762
-  .apm/agents/specky-research-analyst.agent.md: sha256:4bc469d91b8c573cde9097efdbf1ba9fc0bc9580b4e0148e679bb689fbf744b0
-  .apm/agents/specky-sdd-clarify.agent.md: sha256:6dcd4879b2fff198a1fa80d61003eec852d4b1a82b7da1bf46c037a00bd463b6
-  .apm/agents/specky-sdd-init.agent.md: sha256:dff5a301375885781085f0421524cd58ef2305c43084c71e09625c2255182e8a
-  .apm/agents/specky-spec-engineer.agent.md: sha256:1a119fb44d1e48189726d61a1fbe11b2291535defed71316a8dba01f43401efd
-  .apm/agents/specky-task-planner.agent.md: sha256:5be3951932c925d09ff7c0a6066ccad2e25bc9fcc3950088b6966cefe6b98fde
-  .apm/agents/specky-test-verifier.agent.md: sha256:26291f7940f909649da55f8755f0b4a03bbaeae15e2fd61c18f00e7488d44220
-  .apm/hooks/scripts/specky-artifact-validator.sh: sha256:2c255e3221cca919ace520ce319c66cc4904aa9c917ce08a52547fe63f8d9770
-  .apm/hooks/scripts/specky-auto-checkpoint.sh: sha256:46d5a336b20c844469574b2281b5cae24ee5116547a262bb160135aaef38d62e
-  .apm/hooks/scripts/specky-branch-validator.sh: sha256:73256941bdc4aaac518935214c6f0029f32b1529307088243142fe7423594cf6
-  .apm/hooks/scripts/specky-cognitive-debt-alert.sh: sha256:b790bfcc693081e22639704e9f99e76635aa34474b1cdbe2bae2204fc9d69dae
-  .apm/hooks/scripts/specky-drift-monitor.sh: sha256:842636d4e125d855c47dfae1182113f684b0dbe9a215d47105f66a8ccec431f4
-  .apm/hooks/scripts/specky-ears-validator.sh: sha256:96d6b1f64d64d9e230b95f3f90487c8109eb3f72d1420b106fcb2b0d5a2807a0
-  .apm/hooks/scripts/specky-lgtm-gate.sh: sha256:7ec0a7b92dfec4f419785cab0005df452d41ce9f3edcb1c283e7fe93408e9c0b
-  .apm/hooks/scripts/specky-metrics-dashboard.sh: sha256:5893891464add75f138e01717679e8e40c504b757d0520d0131d67210aca82ae
-  .apm/hooks/scripts/specky-phase-gate.sh: sha256:28c2a180b64290312f224dcbc702a50dd812a01200e011e6d662738af113c6e2
-  .apm/hooks/scripts/specky-pipeline-guard.sh: sha256:c985e7d7ad0b31ef4045557122e5d6804707f6c41c7ca89d974822d1557d8b53
-  .apm/hooks/scripts/specky-release-gate.sh: sha256:6216bb9eaeccd761e92673231cfd0d13674f4b0dcd170f58daf8db9d3074cf00
-  .apm/hooks/scripts/specky-security-scan.sh: sha256:eacda868bfffdfd483b820774f86b37e64578effb1019fdffebfd7651348692c
-  .apm/hooks/scripts/specky-session-banner.sh: sha256:731c33f21cf9346258d97f3926a6482e702ff6697afa6b1dda241a9a1c124f51
-  .apm/hooks/scripts/specky-spec-quality.sh: sha256:c0f0a47f108257f75140de5b06619b994d1833462ebba569d4c46fcb973d2e51
-  .apm/hooks/scripts/specky-spec-sync.sh: sha256:48072608e947a19df03b136627c8b7cf01597cee0aed4b15d01fc9f2a5daccea
-  .apm/hooks/scripts/specky-task-tracer.sh: sha256:fe7bf1d20dc48f21b68b78b8540ce6c9bbeb6b1e299b3099579b7cc922fd3588
+  .apm/agents/specky-design-architect.agent.md: sha256:54c69e392e21cbc1097fce8dd9d53d457d2a80d442390c6072c7d8dc5429c47f
+  .apm/agents/specky-implementer.agent.md: sha256:4bad0b5238d185e25011cc01de90a146d2e719ad2621c814989c5e2986f13772
+  .apm/agents/specky-onboarding.agent.md: sha256:ce0ef19ef0a54d354dfe376daf70182689eb938f28675ba50d59c2a728f40e67
+  .apm/agents/specky-orchestrator.agent.md: sha256:4c5199380792fac7a551c5be570d157a064e677d741f0477e841e15d0766c816
+  .apm/agents/specky-quality-reviewer.agent.md: sha256:6e50b686360f780d35c6d2732fefd4d650a613488aba4923e924bafe725521f8
+  .apm/agents/specky-release-engineer.agent.md: sha256:fba4fcc0ebd15e7a77a13f03dd15370bf4f2baf2bed54ede550de26258f37a2f
+  .apm/agents/specky-requirements-engineer.agent.md: sha256:9393480399ced54dd8b201e6821103c9ed9e27fdbdf7426745e0da9535f60ddb
+  .apm/agents/specky-research-analyst.agent.md: sha256:92cd4041e0b021efa310e2cf12abb3c45e8f08e490e4b9bb275a81f4c4845cd9
+  .apm/agents/specky-sdd-clarify.agent.md: sha256:0dac1b774dc616eecddd5937e6ee520de32cdb12482fe3c25181a9e199d82302
+  .apm/agents/specky-sdd-init.agent.md: sha256:884835a042774aa0f94d4442585d3ae9c101496b96645218be6e539d00cb708d
+  .apm/agents/specky-spec-engineer.agent.md: sha256:aeea9446edd6a993b70d46367e1a4f43e847eb199ef6e2e549693721604dd962
+  .apm/agents/specky-task-planner.agent.md: sha256:44f9ef861eb4efa3de02b0d13b66a9abe029bab674e88afd1c4b4af9d8526177
+  .apm/agents/specky-test-verifier.agent.md: sha256:b93435c5947c3f8ee8cc63f0f197d622ad20c45f8b615b23c7b7efbae44e1442
+  .apm/hooks/scripts/specky-artifact-validator.sh: sha256:5d75f3d61ae7a4dd51fc5c8470444c003e983eb7f90edfdbd06fcf614cfa388d
+  .apm/hooks/scripts/specky-auto-checkpoint.sh: sha256:b10018985bc627d33b7a0ef29c2e743b3b6ef20f0d35d60b05c381fd2c58ae53
+  .apm/hooks/scripts/specky-branch-validator.sh: sha256:185e49625b35f6cf926ec3f73a947d05000c2e232a8e55bd2528ac7a32f84a9d
+  .apm/hooks/scripts/specky-cognitive-debt-alert.sh: sha256:125df179fc4778970ddceb6283bcd6f62cf67705c80e452cc389dedecc3f81a5
+  .apm/hooks/scripts/specky-contract-context.bash: sha256:0093dcd64fd7e3e498398208005ac280db71742585d9ed1cc91966491133393a
+  .apm/hooks/scripts/specky-contract-context.mjs: sha256:2a8ce6fc8861ab9668ff36c6cbf260421cf623538a1a7cb7d60ea1a1b1fd60c1
+  .apm/hooks/scripts/specky-drift-monitor.sh: sha256:2050c40fdc74ce636e64c4c4e8b448102eddee77e3a274a26430feb8546d5f90
+  .apm/hooks/scripts/specky-ears-validator.sh: sha256:e267fa02d60fc660a9b1eb022e52fe3514aa0e7890b685e80de231222039b926
+  .apm/hooks/scripts/specky-lgtm-gate.sh: sha256:6ba53f5a9ebc593a0ecc6ccd21fa7006876731c4871cffb11662437a37299b08
+  .apm/hooks/scripts/specky-metrics-dashboard.sh: sha256:05894d6a7fb08c5063f201ed41c4b4a7bc1016958fac823b2344b1847021874f
+  .apm/hooks/scripts/specky-phase-gate.sh: sha256:aacef51523610811f0dc0bcbdbfb883ae9e87c90197e89d6a0f452990cd8e02a
+  .apm/hooks/scripts/specky-pipeline-guard.sh: sha256:cabcc62ff28c3077e7eafb3b1d8e8341242202d17ad16c8bce270e99f891b190
+  .apm/hooks/scripts/specky-release-gate.sh: sha256:7963ea92861ea7bc2f13813ae19f0d618002fa406d64a5bb6c100ad42e28501c
+  .apm/hooks/scripts/specky-security-scan.sh: sha256:5d621e43dec7ac3a9be607ecc622a1548c6f9aefa6f5a470d5d094fb60e41626
+  .apm/hooks/scripts/specky-session-banner.sh: sha256:92928d633f34186f9d35450f6bd02292211dae96ca08ef01a2854aa1deffc82a
+  .apm/hooks/scripts/specky-spec-quality.sh: sha256:2b94a846076807700cdbb157f2ef4bddbe1dfb4b32fbc6d1aed5e4b9a67715cd
+  .apm/hooks/scripts/specky-spec-sync.sh: sha256:a884d4b6d44af3f3c7dcd536c9c9b2dfa08855a54d2020c8f1274f217a2f165f
+  .apm/hooks/scripts/specky-task-tracer.sh: sha256:db4b7fbc5799da2ac2ac7d5b434b03af7797e5d977cdf4e7e26531a8f9eeb96d
   .apm/hooks/sdd-hooks.json: sha256:ec018c950bfca25d9e67da9eb69bdaf6ca9d38ed7ebc5696f6bd06bffdec55f5
-  .apm/hooks/specky-run.sh: sha256:0cb829414419cc05d5a592df130630045ef94d319f292815203b378b571bd721
-  .apm/instructions/claude-instructions.instructions.md: sha256:9b3b77bb220950b3d087b0d5b5999bc60aa4a6d7a07b87fff914e4c1aa872982
-  .apm/instructions/copilot-instructions.instructions.md: sha256:9acf227bde8f64f18b15c174171fa148f6d08dec48f163ad4524da77b4a0c93c
-  .apm/instructions/cursor-instructions.instructions.md: sha256:ee58c87b29de0c58f373834ebee31c469943821f655153febec6bd1f6c649051
-  .apm/instructions/opencode-instructions.instructions.md: sha256:a93d80cef598d99ea4d5116aa64c1e5c8c392316dea31b0448975677a9aac450
+  .apm/hooks/specky-run.sh: sha256:d5d1a41de4aec428c86a358b37fc248df1e0a3856957b01bd0be389aa4124c4d
+  .apm/instructions/claude-instructions.instructions.md: sha256:52eee0c2b4d75830552e6da7aceb33e866d536af71e2a8df17f0c2e5edef304e
+  .apm/instructions/copilot-instructions.instructions.md: sha256:99c8f75e8ed9912d9b7e1198f40eee964e50fdf2dbbe86f65b8d90646a7d4b17
+  .apm/instructions/cursor-instructions.instructions.md: sha256:1e53572ad481e21427c724ac7ee5fab1c2895e4d211feeaa7f6b8fa706f683db
+  .apm/instructions/opencode-instructions.instructions.md: sha256:944db8341600fabcd83e49102fef2c9657462acd57b8f081d56198bb37abcf53
   .apm/prompts/specky-api.prompt.md: sha256:4a13ba39ba58773cbb0bf39c12e462a80d2348aa5fdc4ce612f924658f00c7ed
-  .apm/prompts/specky-brownfield.prompt.md: sha256:0f66839cc82434fead66a7dd5e26934f385afc95a3537b414471f3603b31b4ec
+  .apm/prompts/specky-brownfield.prompt.md: sha256:f3d20312ca7dc7d7c2d0005b9b475fdf7ca542aff77c42511192ba49c1b731cd
   .apm/prompts/specky-check-drift.prompt.md: sha256:f3a04b00ef10167cbd1cdcf63f8b8595d3bc8196d107b48963f8b123f711f3af
   .apm/prompts/specky-clarify.prompt.md: sha256:60ec6230c3dbf2c943896dae07f8643335e55ce6e14a90d91b815fe77aada930
   .apm/prompts/specky-debug-hook.prompt.md: sha256:c5c0054280f3f05103f4ac2459631f6f1494fe10f248bf8c9a4779d83f5d60b4
@@ -48,11 +50,11 @@ primitives:
   .apm/prompts/specky-design.prompt.md: sha256:c125b4e9da56de11160189b6c23665a181b35753cd4c86191925e7896f282f24
   .apm/prompts/specky-from-figma.prompt.md: sha256:0ba1d4d4a9ced39ea89bae8fa98ae3449c2d973510e9a6cf80e3cfe9f29b1fce
   .apm/prompts/specky-from-meeting.prompt.md: sha256:7682a5a2784fd8b9f95e67eca8d8eb21f4755c5c3e5ad4f2c02412493f9ac35f
-  .apm/prompts/specky-greenfield.prompt.md: sha256:64f6cce93ad3fad4f61c72aa079b27bc8c78f43915a8ceff022a3b703fadb230
-  .apm/prompts/specky-implement.prompt.md: sha256:94cb003d5a096b28c099a09cf003dfc3c4da2eb841b859cf1f56f79f5e1bfaec
+  .apm/prompts/specky-greenfield.prompt.md: sha256:07e8c25dbd0a7532f1a23535a88789bd501bacb3fbf7f9501c3b8e9c533f5ea5
+  .apm/prompts/specky-implement.prompt.md: sha256:2253cdf444bb8f3f7472f785f4632b5edfbaa0fe9bc123989320936ba2ec5274
   .apm/prompts/specky-migration.prompt.md: sha256:b0ec812513f30718be36666dd2a4cc377ec099d68928e9bfc691ac14360e36f6
   .apm/prompts/specky-onboarding.prompt.md: sha256:164d338bf9b48b6f4bbaf78ebcdc504f96c871913add892188b53f35f9b72911
-  .apm/prompts/specky-orchestrate.prompt.md: sha256:8b40cc61bed8f85103c0bf6ea5ff4fa4741b0b8af6a18ec71dc8a049434cf62e
+  .apm/prompts/specky-orchestrate.prompt.md: sha256:170aae7b935cfd18607101bea80400e80d6faa362817ccc1eb29c97f6ed590b9
   .apm/prompts/specky-pipeline-status.prompt.md: sha256:3c796d1c8e46c635eda5cb08d890b711ce129308ffa309923874361e7912cc27
   .apm/prompts/specky-release.prompt.md: sha256:6bf07516853fc1ce31d73af9ecaf8c9c49d02c060fd4fe7f9cda329805f3c1c5
   .apm/prompts/specky-research.prompt.md: sha256:bb1040cbfeb90f9c3ecd0ae6f31e3dbfa09e7937c970844d107414fc7b7f54de
@@ -61,21 +63,21 @@ primitives:
   .apm/prompts/specky-specify.prompt.md: sha256:b160f1e6d90657702430a404bd7a372f98161b4c78a1d2f43e827cb0b2dc3e04
   .apm/prompts/specky-tasks.prompt.md: sha256:e06dd4cd6c4e7edddd2bc8319bacc6b4b4c849d3e52ba892fa08f4a77ed711cc
   .apm/prompts/specky-verify.prompt.md: sha256:217327ac0c25b1d39c2fa41390f535aaae38e7c81d8e4cf3127917f44f98d3b9
-  .apm/skills/specky-design-architect/SKILL.md: sha256:2fd4cfccbef9083e5b124b026bceb7caab664675fc72b8144488b14bc4dfbaae
-  .apm/skills/specky-implementer/SKILL.md: sha256:fba84269cb3dc350d5c9dfe307e2dceec635ed4bafe9c4a59e460846acbd267b
-  .apm/skills/specky-onboarding/SKILL.md: sha256:52ad70e7b3962745bd49e636cf2ec27f893f5e8b231c5eabf342db6378af73bd
-  .apm/skills/specky-orchestrator/SKILL.md: sha256:7164ed55355028c8ebb40631b90d9901640aece221039d9fa9764f081643fb1d
-  .apm/skills/specky-quality-reviewer/SKILL.md: sha256:0ed6a9f62d16b0e65eb491f4c30fbf9b87bc4ffd67fce0759f94c85be816db32
-  .apm/skills/specky-release-engineer/SKILL.md: sha256:45e642cca21ca4b27bf78e96d8f16d59a30a3fd9b7d913ac00470d6c0a8ebeea
-  .apm/skills/specky-research-analyst/SKILL.md: sha256:2a136457af156ce9225798a9c25097b0fcf1e6e9582ac55afd60cc03085b38fa
+  .apm/skills/specky-design-architect/SKILL.md: sha256:72d1e3317f13ea005c722c96d2c5fb263f326da1548ddd23c669fab7665e42b8
+  .apm/skills/specky-implementer/SKILL.md: sha256:475cc070ffeaf0fd7a32ce13ef428e9466431ae78319e928b078884d20104b7e
+  .apm/skills/specky-onboarding/SKILL.md: sha256:7fe13985db0bcfbd2a3dde10424949c30aaeb8cabd94c3c5860550f76c8c7601
+  .apm/skills/specky-orchestrator/SKILL.md: sha256:ea59f3fb697e9a80818cd438be012e6dc567f976c2730b96e8e20a90d4c3ac94
+  .apm/skills/specky-quality-reviewer/SKILL.md: sha256:fdba4e24141898c9222dbb38be2f08b0b2ba82950c10088553445b95edf78835
+  .apm/skills/specky-release-engineer/SKILL.md: sha256:a4345263b6414031b4e6ef09938a011438e697b73aa86ee37f3819bc1bce8c87
+  .apm/skills/specky-research-analyst/SKILL.md: sha256:f78ab9100a54c4b438ac9d9b6090c4a7c498d39d3cdba6b8952615bdc7619f1e
   .apm/skills/specky-sdd-clarify/SKILL.md: sha256:7d4958d33b71671fa932b82d88da90f7f055c9ba97e45e1083f7db1b9097f42d
-  .apm/skills/specky-sdd-init/SKILL.md: sha256:a64c25719b1fbc3b74fe85a5b3284261023382dd393f79d73269c7ebe12f7e67
+  .apm/skills/specky-sdd-init/SKILL.md: sha256:5849974e38a3d7dd2e68737d66c8ec932d1dd06107ca594cceeb63e7ecce09d6
   .apm/skills/specky-sdd-markdown-standard/SKILL.md: sha256:ca74b956fa30cc40f2223e6692797f3d7048ddf5b3e082835476fa3e0de1af66
   .apm/skills/specky-sdd-pipeline/references/ears-notation.md: sha256:580dc051802750904ef409b9f89873ad250326bc17c992bd53366b3b1a04f1c5
   .apm/skills/specky-sdd-pipeline/references/model-routing.md: sha256:6ca9bd5cde2a8d227c795d37c4d43b712dd183c10d5d87b987514b494f7c28f3
-  .apm/skills/specky-sdd-pipeline/SKILL.md: sha256:a056e76afcc13964ace69f5fdca001d02870c83e171286b0763919048bbd1027
-  .apm/skills/specky-spec-engineer/SKILL.md: sha256:b5722dacc513a69b54a2d474e1dfa4a25029c5f6f2a930fae3b0ed8f3c9eb49e
-  .apm/skills/specky-task-planner/SKILL.md: sha256:bf391eaa0541ae507f99eacd18a8747b597bcde4ff84d9a389fdc4aad5e76ed7
-  .apm/skills/specky-test-verifier/SKILL.md: sha256:7e663a68f597f409a7209e07830b90b467052583bde8557eed389848baaa8609
-  apm-policy.yml: sha256:421910c17b1a7431f1336d8374538c111245c0c1de58adc6d8eddc185010a639
-  apm.yml: sha256:faaad94df10783caf1226b684caac659685a418e70e3f4172610bdbfc89cdb5e
+  .apm/skills/specky-sdd-pipeline/SKILL.md: sha256:4ba6750b0a3e370fe396980cc63f929f79e94f09542bb97e9c951c40bdc55a82
+  .apm/skills/specky-spec-engineer/SKILL.md: sha256:372ae3faf5cddf9ba90e1133c0117b032f5ae697069d008e3a3f797e78d60e83
+  .apm/skills/specky-task-planner/SKILL.md: sha256:9c1d97624c293525cca9bea253a1f186de593e0d130a5a2b8a704451a200a1f4
+  .apm/skills/specky-test-verifier/SKILL.md: sha256:cae6ad89db7ea84aaaab66665db3dbccd3106aedccd73a0869ae7badcc8a2673
+  apm-policy.yml: sha256:560cfde2c8efe36bdc2cbb095f259506d51312249d3b4cee67640e244e972530
+  apm.yml: sha256:408667a5ff6d41cd041bbabc599aa304a6f05ce2a82fe5bd47a428a776297860

package/apm.yml

@@ -1,5 +1,5 @@
 name: specky-sdd
-version: 3.10.2
+version: 3.11.1
 description: "Agentic Spec-Driven Development — 10-phase pipeline with 58 MCP tools, 13 agents, 22 prompts, 14 skills, 16 hooks, EARS notation, model routing, and enterprise security"
 author: Paula Silva
 license: MIT
@@ -32,7 +32,7 @@ mcp:
       registry: false
       transport: stdio
       command: npx
-      args: ["-y", "specky-sdd@latest", "serve"]
+      args: ["-y", "specky-sdd@3.11.1", "serve"]
       tools: ["sdd_*"]
 
 dependencies:
@@ -41,7 +41,7 @@ dependencies:
       registry: false
       transport: stdio
       command: npx
-      args: ["-y", "specky-sdd@latest"]
+      args: ["-y", "specky-sdd@3.11.1"]
       tools: ["*"]
 
 scripts: