speclock 5.2.5 → 5.3.0

package/README.md

@@ -8,7 +8,7 @@
   <a href="https://www.npmjs.com/package/speclock"><img src="https://img.shields.io/npm/v/speclock.svg?style=flat-square&color=4F46E5" alt="npm version" /></a>
   <a href="https://www.npmjs.com/package/speclock"><img src="https://img.shields.io/npm/dm/speclock.svg?style=flat-square&color=22C55E" alt="npm downloads" /></a>
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/license-MIT-blue.svg?style=flat-square" alt="MIT License" /></a>
-  <a href="https://modelcontextprotocol.io"><img src="https://img.shields.io/badge/MCP-42_tools-green.svg?style=flat-square" alt="MCP 42 tools" /></a>
+  <a href="https://modelcontextprotocol.io"><img src="https://img.shields.io/badge/MCP-42_tools-green.svg?style=flat-square" alt="MCP 46 tools" /></a>
 </p>
 
 <p align="center">
@@ -32,7 +32,8 @@ AI:     ⚠️  BLOCKED — violates lock "Never touch the auth system"
         Should I find another approach?
 ```
 
-**1073 tests. 99.4% pass rate. 0 false positives across 15 suites. Gemini Flash hybrid, Spec Compiler, Code Graph, Typed Constraints, Python SDK, ROS2 integration.**
+**100/100 on Claude's independent test suite. 929 tests across 18 suites. 0 false positives. 15.7ms per check.**
+**Gemini Flash hybrid, Spec Compiler, Code Graph, Typed Constraints, Python SDK, ROS2 integration.**
 
 ---
 
@@ -111,7 +112,7 @@ Same config — add to `.cursor/mcp.json` or equivalent.
 |---|:---:|:---:|:---:|:---:|
 | Remembers context | Yes | Yes | Manual | **Yes** |
 | **Blocks the AI from breaking things** | No | No | No | **Yes** |
-| **Semantic conflict detection** | No | No | No | **98% detection, 0% FP** |
+| **Semantic conflict detection** | No | No | No | **100/100 score, 0% FP** |
 | **Tamper-proof audit trail** | No | No | No | **HMAC-SHA256 chain** |
 | **Hard enforcement (AI cannot proceed)** | No | No | No | **Yes** |
 | **SOC 2 / HIPAA compliance exports** | No | No | No | **Yes** |
@@ -124,9 +125,89 @@ Same config — add to `.cursor/mcp.json` or equivalent.
 
 ---
 
-## Semantic Engine v4
+## Universal Rules Sync (v5.3)
 
-Not keyword matching — **real semantic analysis** with Gemini Flash hybrid for universal domain coverage.
+One command syncs your SpecLock constraints to every AI coding tool:
+
+```bash
+speclock sync --all
+```
+
+```
+SpecLock Sync Complete
+  ✓ Cursor             → .cursor/rules/speclock.mdc
+  ✓ Claude Code        → CLAUDE.md
+  ✓ AGENTS.md          → AGENTS.md (Linux Foundation standard)
+  ✓ Windsurf           → .windsurf/rules/speclock.md
+  ✓ GitHub Copilot     → .github/copilot-instructions.md
+  ✓ Gemini             → GEMINI.md
+  ✓ Aider              → .aider.conf.yml
+
+7 file(s) synced. Your AI tools will now see SpecLock constraints.
+```
+
+Stop maintaining 3 separate rules files. Define constraints once in SpecLock, sync everywhere.
+
+```bash
+speclock sync --format cursor    # Sync to Cursor only
+speclock sync --preview claude   # Preview without writing
+speclock sync --list             # Show all supported formats
+```
+
+---
+
+## Incident Replay (v5.3)
+
+Flight recorder for your AI coding sessions. See exactly what happened:
+
+```bash
+speclock replay
+
+Session: ses_a1b2c3 (claude-code, 47 min)
+────────────────────────────────────────────
+14:02  [ALLOW]   Create user profile component
+14:08  [ALLOW]   Add form validation
+14:15  [WARN]    Simplify authentication flow
+                 → matched lock: "Never modify auth"
+14:23  [BLOCK]   Clean up old user records
+                 → euphemism detected: "clean up" = deletion
+14:31  [ALLOW]   Update landing page hero section
+
+Score: 5 events | 3 allowed | 1 warned | 1 BLOCKED
+```
+
+```bash
+speclock replay --list           # List available sessions
+speclock replay --session <id>   # Replay specific session
+```
+
+---
+
+## Safety Templates (v5.3)
+
+Pre-built constraint packs for common scenarios:
+
+```bash
+speclock template apply safe-defaults   # 5 locks — "Vibe Coding Seatbelt"
+speclock template apply solo-founder    # 3 locks — auth, payments, data
+speclock template apply hipaa           # 8 locks — HIPAA healthcare
+speclock template apply api-stability   # 6 locks — API contract protection
+```
+
+**Safe Defaults** prevents the 5 most common AI disasters:
+1. Database deletion
+2. Auth removal
+3. Secret exposure
+4. Error handling removal
+5. Logging disablement
+
+One command. Instant protection. `npx speclock setup --template safe-defaults`
+
+---
+
+## Semantic Engine
+
+Not keyword matching — **real semantic analysis** with Gemini Flash hybrid for universal domain coverage. Scored **100/100** on Claude's independent adversarial test battery (7 suites, including false positives, question framing, patch gateway, and diff analysis).
 
 <table>
 <tr><td><b>Category</b></td><td><b>Detection</b></td><td><b>Example</b></td></tr>
@@ -143,7 +224,7 @@ Not keyword matching — **real semantic analysis** with Gemini Flash hybrid for
 <tr><td>Safe actions (true negatives)</td><td>0% FP</td><td>"Change the font" correctly passes auth locks</td></tr>
 </table>
 
-**Under the hood:** 65+ synonym groups · 80+ euphemism mappings · domain concept maps (fintech, e-commerce, IoT, healthcare, SaaS, payments) · intent classifier · compound sentence splitter · temporal evasion detector · verb tense normalization · UI cosmetic detection · passive voice parsing — all in pure JavaScript. Gemini Flash hybrid for grey-zone cases ($0.01/1000 checks).
+**Under the hood:** 65+ synonym groups · 80+ euphemism mappings · domain concept maps (fintech, e-commerce, IoT, healthcare, SaaS, payments, gaming, telecom, government) · intent classifier · compound sentence splitter · temporal evasion detector · verb tense normalization · UI cosmetic detection · safe-intent patterns · passive voice parsing — all in pure JavaScript. Gemini Flash hybrid for grey-zone cases ($0.01/1000 checks).
 
 ---
 
@@ -433,7 +514,7 @@ POST /api/v2/graph/build
 
 ---
 
-## 42 MCP Tools
+## 46 MCP Tools
 
 <details>
 <summary><b>Memory</b> — goal, locks, decisions, notes, deploy facts</summary>
@@ -541,6 +622,18 @@ POST /api/v2/graph/build
 
 </details>
 
+<details>
+<summary><b>Universal Rules Sync & Incident Replay</b> — cross-tool sync, session replay (v5.3)</summary>
+
+| Tool | What it does |
+|------|-------------|
+| `speclock_sync_rules` | Sync constraints to Cursor, Claude, Copilot, Windsurf, Gemini, Aider, AGENTS.md |
+| `speclock_list_sync_formats` | List all available sync formats |
+| `speclock_replay` | Replay a session's activity — what AI tried and what was caught |
+| `speclock_list_sessions` | List available sessions for replay |
+
+</details>
+
 ---
 
 ## CLI
@@ -568,8 +661,23 @@ speclock hook install                          # Pre-commit hook
 speclock audit                                 # Audit staged files
 
 # Templates
-speclock template apply nextjs                 # Pre-built constraints
-speclock template apply security-hardened
+speclock template apply safe-defaults          # Vibe coding seatbelt (5 locks)
+speclock template apply solo-founder           # Indie builder essentials (3 locks)
+speclock template apply hipaa                  # HIPAA healthcare (8 locks)
+speclock template apply api-stability          # API contract protection (6 locks)
+speclock template apply nextjs                 # Next.js constraints
+speclock template apply security-hardened      # Security hardening
+
+# Sync to AI tools
+speclock sync --all                            # Sync to ALL tools
+speclock sync --format cursor                  # Cursor only
+speclock sync --format claude                  # Claude Code only
+speclock sync --preview windsurf               # Preview without writing
+
+# Incident Replay
+speclock replay                                # Replay last session
+speclock replay --list                         # List sessions
+speclock replay --session <id>                 # Replay specific session
 
 # Auth
 speclock auth create-key --role developer
@@ -613,7 +721,7 @@ The AI opens the file and sees:
 │     AI Tool (Claude Code, Cursor, Bolt.new...)    │
 └────────────┬──────────────────┬──────────────────┘
              │                  │
-   MCP Protocol (42 tools)    npm File-Based
+   MCP Protocol (46 tools)    npm File-Based
              │              (SPECLOCK.md + CLI)
              │                  │
 ┌────────────▼──────────────────▼──────────────────┐
@@ -659,26 +767,33 @@ The AI opens the file and sees:
 
 ## Test Results
 
+**Pre-publish gate runs all 18 suites before every npm publish. If any test fails, publish is blocked.**
+
 | Suite | Tests | Pass Rate | What it covers |
 |-------|------:|----------:|----------------|
-| Adversarial Conflict | 61 | 100% | Euphemisms, temporal evasion, compound sentences |
-| Typed Constraints | 61 | 100% | Numerical, range, state, temporal validation |
+| Real-World Testers | 111 | 100% | 5 developers, 30+ locks, diverse domains |
+| Adversarial Conflict | 46 | 100% | Euphemisms, temporal evasion, compound sentences |
 | Phase 4 (Multi-domain) | 91 | 100% | Fintech, e-commerce, IoT, healthcare, SaaS |
-| John (Indie Dev Journey) | 86 | 100% | 8-session Bolt.new build with 5 locks |
 | Sam (Enterprise HIPAA) | 124 | 100% | HIPAA locks, PHI, encryption, RBAC |
 | Auth & Crypto | 114 | 100% | API keys, RBAC, AES-256 encryption |
-| Audit Chain | 35 | 100% | HMAC-SHA256 chain integrity |
-| Enforcement | 40 | 100% | Hard/advisory mode, overrides |
+| John (Indie Dev Journey) | 86 | 100% | 8-session Bolt.new build with 5 locks |
+| Diff-Native Review | 76 | 100% | Interface breaks, schema changes, API impact |
+| Patch Gateway | 57 | 100% | ALLOW/WARN/BLOCK verdicts, blast radius |
 | Compliance Export | 50 | 100% | SOC 2, HIPAA, CSV formats |
-| REST API v2 | 28 | 100% | Typed constraint endpoints, SSE |
-| Spec Compiler | 24 | 100% | NL→constraints parsing, auto-apply |
+| Enforcement | 40 | 100% | Hard/advisory mode, overrides |
+| Audit Chain | 35 | 100% | HMAC-SHA256 chain integrity |
 | Code Graph | 33 | 100% | Import parsing, blast radius, lock mapping |
-| Python SDK | 62 | 100% | pip install, constraint checking |
-| ROS2 Guardian | 26 | 100% | Robot safety constraint enforcement |
-| Real-World Testers | 105 | 95% | 5 developers, 30+ locks, diverse domains |
-| **Total** | **940** | **99.4%** | **15 suites, 15 domains** |
+| Spec Compiler | 24 | 100% | NL→constraints parsing, auto-apply |
+| Typed Constraints | 13 | 100% | Numerical, range, state, temporal validation |
+| Claude Regression | 9 | 100% | Vue detection, safe-intent, patch gateway |
+| Question Framing | 9 | 100% | "What if we..." and "How hard would it be..." |
+| REST API v2 | 9 | 100% | Typed constraint endpoints, SSE |
+| PII/Export Detection | 8 | 100% | SSN, email export, data access violations |
+| **Total** | **929** | **100%** | **18 suites, 15+ domains** |
 
-Tested across: fintech, e-commerce, IoT, healthcare, SaaS, gaming, biotech, aerospace, payments, payroll, robotics, autonomous systems. All 11 Indian payment gateways detected. Zero false positives on UI/cosmetic actions.
+**External validation:** Claude's independent 7-suite adversarial test battery — **100/100 (100%)** on v5.3.0. Zero false positives. Zero missed violations. 15.7ms per check.
+
+Tested across: fintech, e-commerce, IoT, healthcare, SaaS, gaming, biotech, aerospace, payments, payroll, robotics, autonomous systems, telecom, insurance, government. All 11 Indian payment gateways detected. Zero false positives on UI/cosmetic actions.
 
 ---
 
@@ -712,8 +827,13 @@ Issues and PRs welcome on [GitHub](https://github.com/sgroy10/speclock).
 
 ## Author
 
-Built by **[Sandeep Roy](https://github.com/sgroy10)**
+**SpecLock** is created and maintained by **[Sandeep Roy](https://github.com/sgroy10)**.
+
+Sandeep Roy is the sole developer of SpecLock — the AI Constraint Engine that enforces project rules across AI coding sessions. All 46 MCP tools, the semantic conflict detection engine, enterprise security features (SOC 2, HIPAA, RBAC, encryption), and the pre-publish test gate were designed and built by Sandeep Roy.
+
+- GitHub: [@sgroy10](https://github.com/sgroy10)
+- npm: [speclock](https://www.npmjs.com/package/speclock)
 
 ---
 
-<p align="center"><i>v5.2.0 — 1073 tests, 99.4% pass rate, 42 MCP tools, Patch Gateway, AI Patch Firewall, Spec Compiler, Code Graph, Typed Constraints, Python SDK, ROS2, REST API v2. Because remembering isn't enough.</i></p>
+<p align="center"><i>SpecLock v5.3.0 — Developed by Sandeep Roy — 929 tests, 100% pass rate, 46 MCP tools, Universal Rules Sync, Incident Replay, AI Patch Firewall, Spec Compiler, Code Graph, Typed Constraints, Python SDK, ROS2, REST API v2. Because remembering isn't enough.</i></p>

package/package.json

@@ -2,9 +2,9 @@
 
   "name": "speclock",
 
-  "version": "5.2.5",
+  "version": "5.3.0",
 
-  "description": "AI Constraint Engine — AI Patch Firewall. Diff-native review (interface breaks, protected symbols, dependency drift, schema changes, API impact), Patch Gateway (ALLOW/WARN/BLOCK verdicts), Spec Compiler (NL→constraints), Code Graph (blast radius, lock-to-file mapping), Typed constraints, REST API v2, Python SDK, ROS2 integration. 42 MCP tools, Gemini LLM hybrid, HMAC audit chain, RBAC, encryption, SOC 2/HIPAA compliance.",
+  "description": "AI Constraint Engine by Sandeep Roy — Universal Rules Sync (one command syncs constraints to Cursor, Claude Code, Copilot, Windsurf, Gemini, Aider, AGENTS.md). AI Patch Firewall, diff-native review, Patch Gateway (ALLOW/WARN/BLOCK), Spec Compiler (NL→constraints), Code Graph (blast radius), Typed constraints, REST API v2, Python SDK, ROS2 integration. 46 MCP tools, Gemini LLM hybrid, HMAC audit chain, RBAC, encryption, SOC 2/HIPAA compliance. Developed by Sandeep Roy.",
 
   "type": "module",
 
@@ -12,91 +12,133 @@
 
   "bin": {
 
-    "speclock": "./bin/speclock.js"
+  
+  "speclock": "./bin/speclock.js"
 
   },
 
   "scripts": {
 
-    "start": "node src/mcp/server.js",
+  
+  "start": "node src/mcp/server.js",
 
-    "serve": "node src/mcp/server.js",
+  
+  "serve": "node src/mcp/server.js",
 
-    "test": "node --experimental-vm-modules node_modules/.bin/jest"
+  
+  "test": "node tests/pre-publish-gate.mjs",
+
+  
+  "prepublishOnly": "node tests/pre-publish-gate.mjs"
 
   },
 
   "keywords": [
 
-    "mcp",
+  
+  "mcp",
 
-    "mcp-server",
+  
+  "mcp-server",
 
-    "ai",
+  
+  "ai",
 
-    "ai-memory",
+  
+  "ai-memory",
 
-    "ai-continuity",
+  
+  "ai-continuity",
 
-    "context",
+  
+  "context",
 
-    "memory",
+  
+  "memory",
 
-    "claude",
+  
+  "claude",
 
-    "claude-code",
+  
+  "claude-code",
 
-    "cursor",
+  
+  "cursor",
 
-    "codex",
+  
+  "codex",
 
-    "windsurf",
+  
+  "windsurf",
 
-    "cline",
+  
+  "cline",
 
-    "speclock",
+  
+  "speclock",
 
-    "ai-amnesia",
+  
+  "ai-amnesia",
 
-    "model-context-protocol",
+  
+  "model-context-protocol",
 
-    "drift-detection",
+  
+  "drift-detection",
 
-    "constraint-enforcement",
+  
+  "constraint-enforcement",
 
-    "enterprise",
+  
+  "enterprise",
 
-    "soc2",
+  
+  "soc2",
 
-    "hipaa",
+  
+  "hipaa",
 
-    "compliance",
+  
+  "compliance",
 
-    "audit-trail",
+  
+  "audit-trail",
 
-    "hmac",
+  
+  "hmac",
 
-    "encryption",
+  
+  "encryption",
 
-    "aes-256",
+  
+  "aes-256",
 
-    "api-key",
+  
+  "api-key",
 
-    "authentication",
+  
+  "authentication",
 
-    "rbac",
+  
+  "rbac",
 
-    "policy-as-code",
+  
+  "policy-as-code",
 
-    "sso",
+  
+  "sso",
 
-    "oauth",
+  
+  "oauth",
 
-    "oidc",
+  
+  "oidc",
 
-    "dashboard",
+  
+  "dashboard",
 
-    "telemetry"
+  
+  "telemetry"
 
   ],
 
@@ -108,79 +150,212 @@
 
   "bugs": {
 
-    "url": "https://github.com/sgroy10/speclock/issues"
+  
+  "url": "https://github.com/sgroy10/speclock/issues"
 
   },
 
   "repository": {
 
-    "type": "git",
+  
+  "type": "git",
 
-    "url": "git+https://github.com/sgroy10/speclock.git"
+  
+  "url": "git+https://github.com/sgroy10/speclock.git"
 
   },
 
   "engines": {
 
-    "node": ">=18"
+  
+  "node": ">=18"
 
   },
 
   "dependencies": {
 
-    "@modelcontextprotocol/sdk": "^1.26.0",
+  
+  "@modelcontextprotocol/sdk": "^1.26.0",
 
-    "chokidar": "^3.6.0",
+  
+  "chokidar": "^3.6.0",
 
-    "zod": "^3.25.0"
+  
+  "zod": "^3.25.0"
 
   },
 
   "files": [
 
-    "bin/",
+  
+  "bin/",
 
-    "src/",
+  
+  "src/",
 
-    "src/dashboard/",
+  
+  "src/dashboard/",
 
-    "README.md",
+  
+  "README.md",
 
-    "SPECLOCK-INSTRUCTIONS.md",
+  
+  "SPECLOCK-INSTRUCTIONS.md",
 
-    "LICENSE"
+  
+  "LICENSE"
 
   ],
 
   "devDependencies": {
 
-    "esbuild": "^0.27.3",
+  
+  "esbuild": "^0.27.3",
 
-    "jest": "^30.2.0"
+  
+  "jest": "^30.2.0"
 
   },
 
   "speclock": {
 
-    "active": true,
+  
+  "active": true,
 
-    "message": "STOP — This project has SpecLock constraints. Read SPECLOCK.md and .speclock/context/latest.md BEFORE making ANY changes. Run 'npx speclock check' before ALL code changes. If a lock below is violated, STOP and ask user to unlock.",
+  
+  "message": "STOP — This project has SpecLock constraints. Read SPECLOCK.md and .speclock/context/latest.md BEFORE making ANY changes. Run 'npx speclock check' before ALL code changes. If a lock below is violated, STOP and ask user to unlock.",
 
-    "locks": [
+  
+  "locks": [
 
-      "Game balance configuration must not be changed",
+  
+  
+  "The /api/refine endpoint response must NOT exceed 5MB total JSON size. If GLB is larger than 3MB after decimation, return file URLs via /api/files/{filename} instead of base64. The browser WILL fail on 20MB+ JSON responses — this was proven when 16MB GLB caused \"Failed to fetch\".",
 
-      "Patient records must never be deleted",
+  
+  
+  "Each Hitem3D run costs ~$2 USD. NEVER deploy untested code that touches the pipeline. Test every API endpoint with curl BEFORE asking user to test. Verify response sizes, status codes, and content. The user's time and money are at stake — treat every deploy as production.",
 
-      "No breaking changes to public API"
+  
+  
+  "Hitem3D settings: model=hitem3dv2.0, resolution=1536pro, face=2000000, request_type=1 (geometry only), format=2 (GLB). Submit+poll architecture — POST /api/generate-3d/submit returns task_id, GET /api/generate-3d/poll/{task_id} polls status. 15 min max poll. These settings are PROVEN WORKING — do not change.",
 
-    ],
+  
+  
+  "NEVER make multiple changes at once. When fixing a bug, fix ONLY that one thing. Do not refactor, do not \"improve\" unrelated code, do not touch working prompts. Test the fix before deploying. One commit per fix.",
 
-    "context": ".speclock/context/latest.md",
+  
+  
+  "Blender refine.py must NOT use voxel_remesh() or subdivide() — these destroy prong tips and stone seat detail. Hitem3D 2M face output has enough detail. Blender only does: scale to mm → light cleanup (remove doubles, fix normals) → sharpen edges → weighted normals → decimate to 100K faces → export STL + GLB.",
 
-    "rules": "SPECLOCK.md"
+  
+  
+  "Wax views must show OPEN THROUGH-HOLES at every stone position — not closed cups. You must see background through each hole. This is production jewelry CAD standard. The sketch prompt must ask for drilled through-holes, gold render must preserve them, wax must clone them exactly.",
 
-  }
+  
+  
+  "JewelCraft Grounding Pattern is MANDATORY. Pipeline: Photo → Pencil Sketch (same angle, through-holes not cups) → Gold Render (from sketch, holes preserved) → Wax Views (from gold render, exact material clone). Each stage feeds PREVIOUS stage's output image. NEVER send original photo to Hitem3D. NEVER skip grounding. NEVER fallback to original image.",
 
-}
+  
+  
+  "Memory system: per-project auto-saved memory (goal, decisions, constraints, context). Stored in PostgreSQL project_memory table. Loaded into system prompt at every conversation turn. User can view/edit in Memory panel. Inspired by Claude memory + OpenClaw bootstrap injection.",
+
+  
+  
+  "SpecLock constraint engine MUST be baked into the codebase — not an external MCP call. Port the core semantics.js logic into the v3 codebase. Auto-detect constraints from conversation, enforce on every generation.",
+
+  
+  
+  "Built-in database for user apps: Railway PostgreSQL with schema-per-project isolation. User never sees connection strings or SQL. AI auto-provisions tables. Free tier: 1 project, 100MB.",
+
+  
+  
+  "VibeLock v3 is a CLEAN BUILD — zero bolt.diy code. Fresh Next.js 15, fresh components, fresh architecture. No copying from the bolt.diy fork. The v3 branch starts empty.",
+
+  
+  
+  "Railway environment variables are already set: DATABASE_URL (Railway PostgreSQL internal), DEEPSEEK_API_KEY, BETTER_AUTH_SECRET, BETTER_AUTH_URL, NEXT_PUBLIC_APP_URL, PORT=5173, NODE_ENV=production, DEFAULT_NUM_CTX=32768. OpenRouter API key is set via OPEN_ROUTER_API_KEY. Add new env vars via Railway GraphQL API or CLI: railway variables set KEY=VALUE.",
+
+  
+  
+  "DEPLOY PIPELINE: Code lives in github.com/sgroy10/vibelock branch v3. Railway project is \"captivating-tranquility\" (ID: ced04e82-b903-458d-9351-ac5944054e92), service ID: 439001ce-1854-454f-8b05-842fa925963f, environment ID: c2cb15c3-9a96-4854-a65c-c3aa0c3ee253. GitHub repo trigger IS connected — git push to the configured branch auto-deploys. Domain: www.vibelock.in. Railway CLI is installed and authenticated as sgroy10@gmail.com. To redeploy from git: use GraphQL mutation serviceInstanceRedeploy. To check deploy status: query deployments via GraphQL. NEVER waste time polling curl — check deploy status via API.",
+
+  
+  
+  "vibelock.in is the LIVE production domain, pointing to Railway project \"captivating-tranquility\". It runs the main branch (Remix/bolt.diy fork codebase). When anyone asks about vibelock.in, this is the codebase — NOT the v2 Next.js branch.",
+
+  
+  
+  "Auto-deploy pipeline: push to git → Railway auto-deploys → URL works. No manual railway up commands. Clean CI/CD from day one.",
+
+  
+  
+  "UI must be Apple-level polished — every pixel matters. Hermes brand colors (orange-black), subtle animations, beautiful typography, perfect spacing. First impressions are critical. No ugly scaffolds, no default gray UIs. Think Lovable/Orchid level branding but with our own identity.",
+
+  
+  
+  "ZERO bolt.diy code — this is a clean-room build. No copy-pasting from the fork. Fresh architecture, fresh components, fresh code. We learned our lesson from 10 hours of debugging someone else's mess.",
+
+  
+  
+  "Non-technical users must NEVER need to configure a database manually. Storage must work out of the box with zero configuration.",
+
+  
+  
+  "Preview experience must match or exceed Lovable/Bolt — responsive preview frames (mobile/tablet/desktop), new-tab preview, fast refresh, and eventually shareable preview links. The sandbox must feel polished and professional.",
+
+  
+  
+  "Rola (robotics layer) must NOT be rushed into production before the core platform (app creation + SpecLock + multilingual + design quality) is rock solid. Stage 4 per vision timeline.",
+
+  
+  
+  "Never expose SpecLock complexity to normal users — its power should be FELT (safety, continuity, nothing breaks) more than explained. No jargon, no constraint IDs, no JSON. Just trust.",
 
+  
+  
+  "VibeLock is NOT a Bolt clone — we are constraint-first, multilingual, and robotics-capable. Every product decision must answer: \"Does this move VibeLock closer to becoming the trusted platform for multilingual natural-language creation of apps, agents, devices, and robot behaviors?\"",
+
+  
+  
+  "Multilingual is NOT just translation — the AI must understand cultural context, respond in the user's language naturally, generate UI labels in the user's language, and make non-English speakers feel first-class. Support Gujarati, Hindi, Spanish, English at minimum, with universal language detection for any language.",
+
+  
+  
+  "SpecLock MUST be automatic and invisible to non-technical users — constraints detected from natural conversation, locked silently, protection felt but not explained. Power users can see the constraint dashboard. No manual setup required.",
+
+  
+  
+  "Every generated app MUST look beautiful by default — modern typography, gradient accents, micro-interactions, proper spacing, responsive design. A todo app must have a stunning landing page. No ugly scaffolds. Design quality is a core differentiator.",
+
+  
+  
+  "ZERO bolt.diy branding anywhere — no \"bolt\" in user-facing UI, page titles, meta tags, social previews, or marketing. Internal code references (CSS variables, artifact tags) must be migrated to vibelock namespace.",
+
+  
+  
+  "Never commit code changes without bumping the version number. Every code change that touches src/ files requires a patch version bump before commit.",
+
+  
+  
+  "Never push code to git without completing the full release checklist: (1) bump version in ALL 7 files (package.json, http-server.js, server.js, compliance.js, cli/index.js, dashboard/index.html x2), (2) npm publish, (3) git commit, (4) git push, (5) git tag vX.Y.Z, (6) git push origin tag, (7) railway up, (8) curl health to verify version. All 8 steps are mandatory — skipping any step is a violation.",
+
+  
+  
+  "Never modify authentication files without security review",
+
+  
+  
+  "No breaking changes to public API"
+
+  
+  ],
+
+  
+  "context": ".speclock/context/latest.md",
+
+  
+  "rules": "SPECLOCK.md"
+
+  }
+}