specpipe 1.0.4 → 2.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specpipe",
-  "version": "1.0.4",
+  "version": "2.1.0",
   "description": "Spec-first development toolkit for agentic AI coding agents — installs skills + guardrails for Claude Code, Codex, Cursor, Antigravity, and more.",
   "bin": {
     "specpipe": "./bin/devkit.js",

package/templates/skills/sp-build/SKILL.md

@@ -274,6 +274,7 @@ Derive a checklist from the spec — each "promise" in this build's scope become
 - Each open `GAP-NNN` (status not `resolved`) → one `[ ]` line tagged `GAP` (so a parked gap is visible, not silently dropped — see Spec Coverage Gate).
 - Each Not-in-Scope row → one `[N/A]` line (prevents accidental ticking).
 - Each matching project-local invariant entry under `docs/invariants/INV-*.md` with `status: enforced` and a `test_ref` → one `INV-###` checklist line carrying the invariant id and test ref. `candidate` and `confirmed` entries are visible risks/spec obligations but not build gates unless the spec turned them into AS/GAP/BM lines. Use the invariant registry README/schema as base knowledge; README examples are not runtime entries.
+- Each confirmed `## Core Function Model` entry point, seam, external contract, invariant, or optional/absent input is checked through AS/GAP/BM/Constraint coverage, not by a separate checklist line unless the spec names an `AS-NNN`/`C-NNN`. A model entry with no coverage is a Spec Signal.
 - Each `## Sibling Surface Map` confirmed surface is checked through its AS/GAP/BM coverage, not by a separate checklist line. Candidate rows with `GAP-NNN` or `ignore(reason)` are visible context only. A candidate row with missing disposition is a spec signal, not a build requirement to implement.
 
 **Completeness invariant (checked, not hoped):** every `AS-NNN` and `C-NNN` in the spec's `## Stories`/Constraints MUST appear on ≥1 checklist line. Every `Coverage = AS-NNN` Behavior Matrix cell MUST appear on exactly one `BM.AS-*` checklist line; every `Coverage = GAP-NNN` Behavior Matrix cell MUST appear on exactly one `GAP-* — BM cell unresolved` checklist line; every `Coverage = N/A` Behavior Matrix cell MUST appear on one `[N/A] BM.NA.*` checklist line. An AS with no line = the checklist is wrong (re-derive), not the spec. A Behavior Matrix cell with no line = QA coverage was dropped. Deriving from Then-nouns alone silently drops AS whose Then is verb-shaped ("retries", "must not send") or whose nouns collide with another AS — anchoring on the ID closes that.
@@ -390,6 +391,8 @@ Before writing tests, trace all paths and draw a diagram to see gaps upfront —
 - External/provider surface (calendar/email/payment/identity) → contract/integration against the verified boundary or provider fake that is itself verified; never a pure mock of the boundary under test.
 - Timing/source cell (`realtime`, `refresh-required`, `persisted+served`, `transient`) → the test must assert that lifecycle point, not just the immediate action response.
 
+**Step 2c — Trace Core Function Model:** If the spec has `## Core Function Model`, copy confirmed entry points, internal seams, external contracts, invariants, optional/absent inputs, and unknown semantics into the Coverage Map. Each item must point to `AS-NNN`, `C-NNN`, `GAP-NNN`, or BM coverage. A model item without coverage is a Spec Signal, not permission to invent behavior. Provider/external semantics require a real boundary assertion at the named seam; do not mock the seam the test claims to verify.
+
 In the diagram, prefix these rows with `[BM]` and keep the AS id visible:
 
 ```
@@ -725,6 +728,17 @@ grep '^\\[x\\] BM\\.AS' "$CHECKLIST" | grep -vE '[[:alnum:]_./-]+:[[:alnum:]_ -]
 - **Any terminal lifecycle BM line without a named cascade test → treat as `[~]` or BLOCKED**, depending on release criticality.
 - **Any `GAP-NNN — BM cell unresolved` line → visible open gap, not a build test failure.** Do not implement or test that cell until `/sp-plan` resolves it.
 
+### Core Function Model Gate
+
+Run this when the spec contains `## Core Function Model`.
+
+- Confirmed entry points, seams, provider/external contracts, invariants, and optional/absent inputs must be represented by AS/GAP/BM/Constraint lines.
+- Optional/absent inputs named by the model need a regression AS or GAP.
+- External/provider semantics that affect behavior need AS if stated or GAP if unknown.
+- Any verified code seam claimed in the model must have test evidence at the correct boundary.
+- **No-vacuous-boundary rule:** do not mock the seam the test claims to verify. Mock outside dependencies only.
+- A model entry with no AS/GAP/BM/Constraint coverage means `/sp-plan` did not finish. Emit a Spec Signal and mark DONE_WITH_CONCERNS or BLOCKED depending on release criticality.
+
 ### Sibling Surface Map Gate
 
 Run this when the spec contains `## Sibling Surface Map`.
@@ -820,6 +834,7 @@ TDD evidence: [S-001: RED (paste 1st failing assertion raw) → GREEN ✓ | test
 Checklist: X/Y [x], A/Y [~] (destinations: <story-id list or Known-Gap refs>), B/Y [ ] (reasons), C/Y [N/A]
 Coverage gate (Phase 3.5): PASS — all AS/C carry a test | BLOCKED — uncovered: <AS/C ids>   (breadth)
 Behavior Matrix gate: PASS — all BM cells [x] | BLOCKED — uncovered: <BM lines> | CONCERNS — partial/mocked-boundary: <BM lines>
+Core Function Model gate: PASS — model entries covered at correct seam | CONCERNS/BLOCKED — missing coverage or vacuous boundary: <items> | N/A
 Sibling Surface Map gate: PASS — confirmed surfaces covered | CONCERNS — candidate disposition/spec signal: <candidate ids> | N/A
 Invariant gate: PASS — enforced invariants covered | BLOCKED — missing enforced invariant tests: <INV ids> | N/A — no enforced invariants touched
 Edge Case Compliance: [per-story table — every row ✓ or N/A+reason]   (depth)

package/templates/skills/sp-build-behavior-matrix/SKILL.md

@@ -274,6 +274,7 @@ Derive a checklist from the spec — each "promise" in this build's scope become
 - Each open `GAP-NNN` (status not `resolved`) → one `[ ]` line tagged `GAP` (so a parked gap is visible, not silently dropped — see Spec Coverage Gate).
 - Each Not-in-Scope row → one `[N/A]` line (prevents accidental ticking).
 - Each matching project-local invariant entry under `docs/invariants/INV-*.md` with `status: enforced` and a `test_ref` → one `INV-###` checklist line carrying the invariant id and test ref. `candidate` and `confirmed` entries are visible risks/spec obligations but not build gates unless the spec turned them into AS/GAP/BM lines. Use the invariant registry README/schema as base knowledge; README examples are not runtime entries.
+- Each confirmed `## Core Function Model` entry point, seam, external contract, invariant, or optional/absent input is checked through AS/GAP/BM/Constraint coverage, not by a separate checklist line unless the spec names an `AS-NNN`/`C-NNN`. A model entry with no coverage is a Spec Signal.
 - Each `## Sibling Surface Map` confirmed surface is checked through its AS/GAP/BM coverage, not by a separate checklist line. Candidate rows with `GAP-NNN` or `ignore(reason)` are visible context only. A candidate row with missing disposition is a spec signal, not a build requirement to implement.
 
 **Completeness invariant (checked, not hoped):** every `AS-NNN` and `C-NNN` in the spec's `## Stories`/Constraints MUST appear on ≥1 checklist line. Every `Coverage = AS-NNN` Behavior Matrix cell MUST appear on exactly one `BM.AS-*` checklist line; every `Coverage = GAP-NNN` Behavior Matrix cell MUST appear on exactly one `GAP-* — BM cell unresolved` checklist line; every `Coverage = N/A` Behavior Matrix cell MUST appear on one `[N/A] BM.NA.*` checklist line. An AS with no line = the checklist is wrong (re-derive), not the spec. A Behavior Matrix cell with no line = QA coverage was dropped. Deriving from Then-nouns alone silently drops AS whose Then is verb-shaped ("retries", "must not send") or whose nouns collide with another AS — anchoring on the ID closes that.
@@ -390,6 +391,8 @@ Before writing tests, trace all paths and draw a diagram to see gaps upfront —
 - External/provider surface (calendar/email/payment/identity) → contract/integration against the verified boundary or provider fake that is itself verified; never a pure mock of the boundary under test.
 - Timing/source cell (`realtime`, `refresh-required`, `persisted+served`, `transient`) → the test must assert that lifecycle point, not just the immediate action response.
 
+**Step 2c — Trace Core Function Model:** If the spec has `## Core Function Model`, copy confirmed entry points, internal seams, external contracts, invariants, optional/absent inputs, and unknown semantics into the Coverage Map. Each item must point to `AS-NNN`, `C-NNN`, `GAP-NNN`, or BM coverage. A model item without coverage is a Spec Signal, not permission to invent behavior. Provider/external semantics require a real boundary assertion at the named seam; do not mock the seam the test claims to verify.
+
 In the diagram, prefix these rows with `[BM]` and keep the AS id visible:
 
 ```
@@ -725,6 +728,17 @@ grep '^\\[x\\] BM\\.AS' "$CHECKLIST" | grep -vE '[[:alnum:]_./-]+:[[:alnum:]_ -]
 - **Any terminal lifecycle BM line without a named cascade test → treat as `[~]` or BLOCKED**, depending on release criticality.
 - **Any `GAP-NNN — BM cell unresolved` line → visible open gap, not a build test failure.** Do not implement or test that cell until `/sp-plan` resolves it.
 
+### Core Function Model Gate
+
+Run this when the spec contains `## Core Function Model`.
+
+- Confirmed entry points, seams, provider/external contracts, invariants, and optional/absent inputs must be represented by AS/GAP/BM/Constraint lines.
+- Optional/absent inputs named by the model need a regression AS or GAP.
+- External/provider semantics that affect behavior need AS if stated or GAP if unknown.
+- Any verified code seam claimed in the model must have test evidence at the correct boundary.
+- **No-vacuous-boundary rule:** do not mock the seam the test claims to verify. Mock outside dependencies only.
+- A model entry with no AS/GAP/BM/Constraint coverage means `/sp-plan` did not finish. Emit a Spec Signal and mark DONE_WITH_CONCERNS or BLOCKED depending on release criticality.
+
 ### Sibling Surface Map Gate
 
 Run this when the spec contains `## Sibling Surface Map`.
@@ -820,6 +834,7 @@ TDD evidence: [S-001: RED (paste 1st failing assertion raw) → GREEN ✓ | test
 Checklist: X/Y [x], A/Y [~] (destinations: <story-id list or Known-Gap refs>), B/Y [ ] (reasons), C/Y [N/A]
 Coverage gate (Phase 3.5): PASS — all AS/C carry a test | BLOCKED — uncovered: <AS/C ids>   (breadth)
 Behavior Matrix gate: PASS — all BM cells [x] | BLOCKED — uncovered: <BM lines> | CONCERNS — partial/mocked-boundary: <BM lines>
+Core Function Model gate: PASS — model entries covered at correct seam | CONCERNS/BLOCKED — missing coverage or vacuous boundary: <items> | N/A
 Sibling Surface Map gate: PASS — confirmed surfaces covered | CONCERNS — candidate disposition/spec signal: <candidate ids> | N/A
 Invariant gate: PASS — enforced invariants covered | BLOCKED — missing enforced invariant tests: <INV ids> | N/A — no enforced invariants touched
 Edge Case Compliance: [per-story table — every row ✓ or N/A+reason]   (depth)

package/templates/skills/sp-challenge/SKILL.md

@@ -30,6 +30,7 @@ Map the plan's attack surface:
 - Scope boundaries (in/out/suspiciously unmentioned)
 - Risk acknowledgments (mentioned vs. conspicuously absent)
 - Story↔AS consistency (stories without acceptance scenarios? contradictions?)
+- Core Function Model coverage if present: operation, inputs, entry points, seams, provider contracts, invariants, unknown semantics, and whether each confirmed item maps to AS/GAP/Constraint/BM
 - Behavior Matrix coverage if present: every state/viewer/surface cell, its AS/GAP/N/A coverage, suspicious N/A cells, weak AS cells, missing surfaces, and cascade/parity obligations
 
 Collect all file paths the reviewers will need to read.
@@ -43,9 +44,11 @@ Assess plan complexity and select which lenses to deploy:
 | Simple (1 spec section, <20 acceptance scenarios, no auth/data) | 2 | Assumptions + Scope |
 | Standard (multiple sections, auth or data involved) | 3 | + Security |
 | Complex (multiple integrations, concurrency, migrations, 6+ phases) | 4 | + Failure Modes |
+| Core Function Model present, or feature changes provider/payment/auth/data mutation/optional input | +1 reviewer, replacing the lowest-value generic lens if needed to stay capped at 4 | + Core Function & Contract |
 | Behavior Matrix present (`## Behavior Matrix`) | +1 reviewer, replacing the lowest-value generic lens if needed to stay capped at 4 | + Lifecycle & Parity |
 
 When in doubt, use 3 reviewers. 4 is for genuinely complex plans.
+If `## Core Function Model` exists, always include the Core Function & Contract lens. This lens is not optional: the model exists because the feature has operation/input/seam/provider risk.
 If `## Behavior Matrix` exists, always include the Lifecycle & Parity lens. This lens is not optional: the matrix exists because the feature has state/viewer/surface risk.
 
 ## Phase 3: Spawn Parallel Reviewers
@@ -111,6 +114,23 @@ Examine the plan for:
 - OWASP Top 10 (2021): Broken Access Control, Crypto Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable Components, Identity Failures, Integrity Failures, Logging Failures, SSRF
 ```
 
+**Core Function & Contract Reviewer:**
+```
+You are reviewing whether the spec models the operation deeply enough before code.
+
+Use ONLY stated requirements, related specs, verified code references, and explicit GAPs. Do not invent provider behavior or extra edge cases. Your job is to catch missing operation/input/seam/provider coverage.
+
+Examine the plan for:
+- Missing Core Function Model when the feature changes an operation, optional input, provider/external contract, payment/auth/data mutation, stateful flow, or bug-fix path.
+- Incomplete model rows: operation, inputs, entry points, internal seams, external contracts, invariants, or unknown semantics missing without reason.
+- Optional-input holes: omitted input/no-op regression absent when an optional input is added or changed.
+- Provider contract holes: typed IDs, plan applicability, duration/trial/deferred effects, retries/webhooks, rate limits, fail-closed behavior, or server revalidation stated in requirements/code but missing from AS/GAP/Constraint.
+- Code-seam weakness: public entry -> service/helper -> provider/db/cache boundary is not verified, or file:line/symbol/config claims look stale/fabricated.
+- Over-assertion: AS guesses provider semantics that should be GAP because requirements/code do not state it.
+
+For suggested fixes, update the spec: add/repair Core Function Model row, add AS/GAP/Constraint, or correct the code reference. Do not suggest implementation code.
+```
+
 **Failure Mode Analyst:**
 ```
 You believe Murphy's Law: everything that can go wrong, will — simultaneously, at 3 AM, during peak traffic.
@@ -162,6 +182,8 @@ You are the QA lead who historically found state/viewer/surface bugs on staging.
 Use ONLY the plan's stated states, viewers, surfaces, AS, GAP, N/A, constraints, linked fields, and impact map. Do not invent unrelated edge cases. Focus on whether the matrix faithfully covers the behavior the plan already triggered.
 
 Examine the plan for:
+- Missing Core Function Model: if the plan changes an operation, input, provider seam, payment/auth/data mutation, or external contract, check whether it has `## Core Function Model` or an explicit reason it is not applicable.
+- Weak provider contract: provider IDs, lifecycle timing, trial/deferred effects, retries/webhooks, and fail-closed behavior must be AS/GAP/Constraint, not only prose.
 - Missing axes: states/statuses, viewer roles/relationships, or surfaces named elsewhere in the spec but absent from `## Behavior Matrix`.
 - Missing sibling discovery: if the plan changes an existing operation or bug-fix path, check whether it has `## Sibling Surface Map` or an explicit reason discovery is not applicable. High/medium sibling candidates must be `cover`, `GAP-NNN`, or `ignore(reason)`; only `cover` candidates may feed Behavior Matrix surfaces.
 - Missing invariant context: if the plan touches a component named by project-local `docs/invariants/INV-*.md`, confirm the relevant invariant is represented in Constraints, GAPs, Behavior Matrix, or explicitly ignored with a reason. Use the invariant registry README/schema as base knowledge only; README examples are not runtime entries. Do not invent new invariant entries here.
@@ -199,10 +221,11 @@ After all reviewers complete:
 4. **Sort** by severity: Critical → High → Medium → Low
 5. **Cap** at 15 findings: keep all Critical, top High by specificity, note how many Medium were dropped
 6. **Cross-reference check** (you, not reviewers): Flag any stories without acceptance scenarios, and any AS that contradicts the story description
-7. **Behavior Matrix cross-check** (you, not reviewers, when present): Every matrix `Coverage = AS-NNN` must point to an AS that actually asserts the same state/viewer/surface outcome; every `GAP-NNN` must exist in `## Gaps`; every `N/A` must have a reason. Missing or mismatched cells are accepted findings unless another reviewer already caught them.
-8. **Suspicious N/A/GAP Review cross-check** (you, not reviewers, when present): If the plan has `## Behavior Matrix` and any `N/A` or `GAP` cell, the final challenge output MUST include a `Suspicious N/A/GAP Review` section. Omission is itself a Medium finding because it lets lifecycle/viewer/surface blind spots hide behind "not applicable" or unresolved gaps.
-9. **Sibling Surface Map cross-check** (you, not reviewers, when present): If `## Sibling Surface Map` exists, every high/medium candidate must have a disposition (`cover`, `GAP-NNN`, or `ignore(reason)`). If the plan touches an existing operation and has no map, flag missing discovery unless the plan states why sibling discovery is not applicable.
-10. **Invariant registry cross-check** (you, not reviewers, when present): If project-local `docs/invariants/INV-*.md` contains an entry matching the planned component, the plan must either carry it into Constraints/Behavior Matrix/GAPs or explicitly state why it does not apply. Missing invariant handling is a Medium/High finding depending on `status`.
+7. **Core Function Model cross-check** (you, not reviewers, when present): Every confirmed operation/input/entry-point/seam/provider contract/invariant row must map to AS/GAP/Constraint/BM. If provider/external semantics are unknown, there must be a GAP. If the plan changes an operation/provider/input but has no model, flag missing CFM unless it states why not applicable.
+8. **Behavior Matrix cross-check** (you, not reviewers, when present): Every matrix `Coverage = AS-NNN` must point to an AS that actually asserts the same state/viewer/surface outcome; every `GAP-NNN` must exist in `## Gaps`; every `N/A` must have a reason. Missing or mismatched cells are accepted findings unless another reviewer already caught them.
+9. **Suspicious N/A/GAP Review cross-check** (you, not reviewers, when present): If the plan has `## Behavior Matrix` and any `N/A` or `GAP` cell, the final challenge output MUST include a `Suspicious N/A/GAP Review` section. Omission is itself a Medium finding because it lets lifecycle/viewer/surface blind spots hide behind "not applicable" or unresolved gaps.
+10. **Sibling Surface Map cross-check** (you, not reviewers, when present): If `## Sibling Surface Map` exists, every high/medium candidate must have a disposition (`cover`, `GAP-NNN`, or `ignore(reason)`). If the plan touches an existing operation and has no map, flag missing discovery unless the plan states why sibling discovery is not applicable.
+11. **Invariant registry cross-check** (you, not reviewers, when present): If project-local `docs/invariants/INV-*.md` contains an entry matching the planned component, the plan must either carry it into Constraints/Behavior Matrix/GAPs or explicitly state why it does not apply. Missing invariant handling is a Medium/High finding depending on `status`.
 
 ## Phase 5: Adjudicate
 

package/templates/skills/sp-challenge-behavior-matrix/SKILL.md

@@ -30,6 +30,7 @@ Map the plan's attack surface:
 - Scope boundaries (in/out/suspiciously unmentioned)
 - Risk acknowledgments (mentioned vs. conspicuously absent)
 - Story↔AS consistency (stories without acceptance scenarios? contradictions?)
+- Core Function Model coverage if present: operation, inputs, entry points, seams, provider contracts, invariants, unknown semantics, and whether each confirmed item maps to AS/GAP/Constraint/BM
 - Behavior Matrix coverage if present: every state/viewer/surface cell, its AS/GAP/N/A coverage, suspicious N/A cells, weak AS cells, missing surfaces, and cascade/parity obligations
 
 Collect all file paths the reviewers will need to read.
@@ -43,9 +44,11 @@ Assess plan complexity and select which lenses to deploy:
 | Simple (1 spec section, <20 acceptance scenarios, no auth/data) | 2 | Assumptions + Scope |
 | Standard (multiple sections, auth or data involved) | 3 | + Security |
 | Complex (multiple integrations, concurrency, migrations, 6+ phases) | 4 | + Failure Modes |
+| Core Function Model present, or feature changes provider/payment/auth/data mutation/optional input | +1 reviewer, replacing the lowest-value generic lens if needed to stay capped at 4 | + Core Function & Contract |
 | Behavior Matrix present (`## Behavior Matrix`) | +1 reviewer, replacing the lowest-value generic lens if needed to stay capped at 4 | + Lifecycle & Parity |
 
 When in doubt, use 3 reviewers. 4 is for genuinely complex plans.
+If `## Core Function Model` exists, always include the Core Function & Contract lens. This lens is not optional: the model exists because the feature has operation/input/seam/provider risk.
 If `## Behavior Matrix` exists, always include the Lifecycle & Parity lens. This lens is not optional: the matrix exists because the feature has state/viewer/surface risk.
 
 ## Phase 3: Spawn Parallel Reviewers
@@ -111,6 +114,23 @@ Examine the plan for:
 - OWASP Top 10 (2021): Broken Access Control, Crypto Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable Components, Identity Failures, Integrity Failures, Logging Failures, SSRF
 ```
 
+**Core Function & Contract Reviewer:**
+```
+You are reviewing whether the spec models the operation deeply enough before code.
+
+Use ONLY stated requirements, related specs, verified code references, and explicit GAPs. Do not invent provider behavior or extra edge cases. Your job is to catch missing operation/input/seam/provider coverage.
+
+Examine the plan for:
+- Missing Core Function Model when the feature changes an operation, optional input, provider/external contract, payment/auth/data mutation, stateful flow, or bug-fix path.
+- Incomplete model rows: operation, inputs, entry points, internal seams, external contracts, invariants, or unknown semantics missing without reason.
+- Optional-input holes: omitted input/no-op regression absent when an optional input is added or changed.
+- Provider contract holes: typed IDs, plan applicability, duration/trial/deferred effects, retries/webhooks, rate limits, fail-closed behavior, or server revalidation stated in requirements/code but missing from AS/GAP/Constraint.
+- Code-seam weakness: public entry -> service/helper -> provider/db/cache boundary is not verified, or file:line/symbol/config claims look stale/fabricated.
+- Over-assertion: AS guesses provider semantics that should be GAP because requirements/code do not state it.
+
+For suggested fixes, update the spec: add/repair Core Function Model row, add AS/GAP/Constraint, or correct the code reference. Do not suggest implementation code.
+```
+
 **Failure Mode Analyst:**
 ```
 You believe Murphy's Law: everything that can go wrong, will — simultaneously, at 3 AM, during peak traffic.
@@ -162,6 +182,8 @@ You are the QA lead who historically found state/viewer/surface bugs on staging.
 Use ONLY the plan's stated states, viewers, surfaces, AS, GAP, N/A, constraints, linked fields, and impact map. Do not invent unrelated edge cases. Focus on whether the matrix faithfully covers the behavior the plan already triggered.
 
 Examine the plan for:
+- Missing Core Function Model: if the plan changes an operation, input, provider seam, payment/auth/data mutation, or external contract, check whether it has `## Core Function Model` or an explicit reason it is not applicable.
+- Weak provider contract: provider IDs, lifecycle timing, trial/deferred effects, retries/webhooks, and fail-closed behavior must be AS/GAP/Constraint, not only prose.
 - Missing axes: states/statuses, viewer roles/relationships, or surfaces named elsewhere in the spec but absent from `## Behavior Matrix`.
 - Missing sibling discovery: if the plan changes an existing operation or bug-fix path, check whether it has `## Sibling Surface Map` or an explicit reason discovery is not applicable. High/medium sibling candidates must be `cover`, `GAP-NNN`, or `ignore(reason)`; only `cover` candidates may feed Behavior Matrix surfaces.
 - Missing invariant context: if the plan touches a component named by project-local `docs/invariants/INV-*.md`, confirm the relevant invariant is represented in Constraints, GAPs, Behavior Matrix, or explicitly ignored with a reason. Use the invariant registry README/schema as base knowledge only; README examples are not runtime entries. Do not invent new invariant entries here.
@@ -199,10 +221,11 @@ After all reviewers complete:
 4. **Sort** by severity: Critical → High → Medium → Low
 5. **Cap** at 15 findings: keep all Critical, top High by specificity, note how many Medium were dropped
 6. **Cross-reference check** (you, not reviewers): Flag any stories without acceptance scenarios, and any AS that contradicts the story description
-7. **Behavior Matrix cross-check** (you, not reviewers, when present): Every matrix `Coverage = AS-NNN` must point to an AS that actually asserts the same state/viewer/surface outcome; every `GAP-NNN` must exist in `## Gaps`; every `N/A` must have a reason. Missing or mismatched cells are accepted findings unless another reviewer already caught them.
-8. **Suspicious N/A/GAP Review cross-check** (you, not reviewers, when present): If the plan has `## Behavior Matrix` and any `N/A` or `GAP` cell, the final challenge output MUST include a `Suspicious N/A/GAP Review` section. Omission is itself a Medium finding because it lets lifecycle/viewer/surface blind spots hide behind "not applicable" or unresolved gaps.
-9. **Sibling Surface Map cross-check** (you, not reviewers, when present): If `## Sibling Surface Map` exists, every high/medium candidate must have a disposition (`cover`, `GAP-NNN`, or `ignore(reason)`). If the plan touches an existing operation and has no map, flag missing discovery unless the plan states why sibling discovery is not applicable.
-10. **Invariant registry cross-check** (you, not reviewers, when present): If project-local `docs/invariants/INV-*.md` contains an entry matching the planned component, the plan must either carry it into Constraints/Behavior Matrix/GAPs or explicitly state why it does not apply. Missing invariant handling is a Medium/High finding depending on `status`.
+7. **Core Function Model cross-check** (you, not reviewers, when present): Every confirmed operation/input/entry-point/seam/provider contract/invariant row must map to AS/GAP/Constraint/BM. If provider/external semantics are unknown, there must be a GAP. If the plan changes an operation/provider/input but has no model, flag missing CFM unless it states why not applicable.
+8. **Behavior Matrix cross-check** (you, not reviewers, when present): Every matrix `Coverage = AS-NNN` must point to an AS that actually asserts the same state/viewer/surface outcome; every `GAP-NNN` must exist in `## Gaps`; every `N/A` must have a reason. Missing or mismatched cells are accepted findings unless another reviewer already caught them.
+9. **Suspicious N/A/GAP Review cross-check** (you, not reviewers, when present): If the plan has `## Behavior Matrix` and any `N/A` or `GAP` cell, the final challenge output MUST include a `Suspicious N/A/GAP Review` section. Omission is itself a Medium finding because it lets lifecycle/viewer/surface blind spots hide behind "not applicable" or unresolved gaps.
+10. **Sibling Surface Map cross-check** (you, not reviewers, when present): If `## Sibling Surface Map` exists, every high/medium candidate must have a disposition (`cover`, `GAP-NNN`, or `ignore(reason)`). If the plan touches an existing operation and has no map, flag missing discovery unless the plan states why sibling discovery is not applicable.
+11. **Invariant registry cross-check** (you, not reviewers, when present): If project-local `docs/invariants/INV-*.md` contains an entry matching the planned component, the plan must either carry it into Constraints/Behavior Matrix/GAPs or explicitly state why it does not apply. Missing invariant handling is a Medium/High finding depending on `status`.
 
 ## Phase 5: Adjudicate
 

package/templates/skills/sp-explore/SKILL.md

@@ -141,14 +141,31 @@ Also note the **project domain** from CLAUDE.md (payment, booking, content, heal
 
 ---
 
-## Phase 0.5 — Sibling Discovery Pass (candidate only)
+## Phase 0.5 — Core Function Discovery (candidate only)
 
-Run this after Phase 0 when the feature changes an existing operation, fixes a bug, or touches state/viewer/surface behavior. Purpose: find sibling entry-points that perform the same domain operation but may not be named in the ticket.
+Run this after Phase 0 when the feature changes an existing operation, fixes a bug, touches state/viewer/surface behavior, or integrates with an external provider. Purpose: model the core operation before asking or planning, so later AS/GAP/BM work is driven by the actual function, entry points, seams, and contracts.
 
-This pass produces candidates, not requirements. A candidate may become a confirmed surface only after the user/spec/code evidence supports it. Do not auto-promote noisy matches into acceptance scenarios.
+This pass produces candidates and evidence, not requirements. A candidate may become a confirmed surface/contract only after the user/spec/code evidence supports it. Do not auto-promote noisy matches into acceptance scenarios.
 
 **Inputs:** raw symptom text, feature nouns, touched component/module, existing code hits from Phase 0, matching project-local `docs/invariants/INV-*.md` entries, and any shared anchors/constants already found.
 
+### Core Function Model
+
+Record the model first:
+
+| Field | Evidence |
+|---|---|
+| Operation | `<create subscription / validate coupon / create appointment / send invite / etc.>` |
+| Inputs | required / optional / absent inputs; identify no-op/omitted-input behavior |
+| Entry points | UI/API/job/webhook/provider callback surfaces that can invoke the operation |
+| Internal seams | route -> service/helper -> provider/db/cache/read-model; include injected/test seams |
+| External contracts | provider/API semantics, IDs, lifecycle timing, retries, trial/deferred effects |
+| State/surface axes | lifecycle/viewer/surface axes if triggered; otherwise `N/A: stateless` |
+| Invariants | fail-closed, server revalidation, no-op unchanged, parity/cascade, no partial side effect |
+| Unknown semantics | must become open questions/GAPs; do not guess provider behavior |
+
+### Entry-point / sibling discovery
+
 **Deterministic recipe:**
 
 1. **Seed nouns and verbs:** extract 3-8 terms such as domain object (`appointment`, `invite`, `matchup`), operation (`create`, `reschedule`, `cancel`, `send`), and surface nouns (`outreach`, `modal`, `guide`, `calendar`, `queue`).
@@ -157,7 +174,7 @@ This pass produces candidates, not requirements. A candidate may become a confir
 4. **Git change-coupling:** inspect recent co-change around seed files with `git log --name-only -- <seed-file>` and look for files/functions repeatedly changed with the seed. This is recall-oriented evidence, not proof.
 5. **GA blast radius if available:** use `ga_impact` for touched symbols/files to find connected blast radius, but do not treat importers-only output as complete sibling discovery. Siblings may be co-changed or share anchors without importing each other.
 
-Record every plausible sibling in a table:
+Record every plausible entry point / sibling in a table:
 
 | Candidate | Operation | Evidence | Confidence | Obligation |
 |---|---|---|---|---|
@@ -172,7 +189,7 @@ Rules:
 - `GAP`: candidate seems material but expected behavior/scope is unknown.
 - `ignore(reason)`: candidate is false positive or intentionally out of scope.
 
-Exit condition: every high/medium candidate has `cover`, `GAP`, or `ignore(reason)`. Low-confidence candidates can be listed as notes and do not block handoff.
+Exit condition: the Core Function Model is filled for every triggered field, and every high/medium entry-point candidate has `cover`, `GAP-NNN`, or `ignore(reason)`. Low-confidence candidates can be listed as notes and do not block handoff.
 
 ---
 
@@ -719,6 +736,18 @@ Timeout: [if role B does not act within X hours then...]
 
 **Behavior Matrix discovery axes:** _(required for stateful / role-sensitive / multi-surface features; consumed by `/sp-plan`)_
 
+Core Function Model: _(required when Phase 0.5 ran; consumed by `/sp-plan`)_
+| Field | Evidence |
+|---|---|
+| Operation | [core operation being changed] |
+| Inputs | [required / optional / absent inputs + no-op behavior] |
+| Entry points | [UI/API/job/webhook/provider callbacks] |
+| Internal seams | [route -> service/helper -> provider/db/cache/read-model; include test seam] |
+| External contracts | [provider semantics / lifecycle / retries / trial/deferred effects, or N/A] |
+| State/surface axes | [states/viewers/surfaces triggered, or N/A with reason] |
+| Invariants | [fail-closed / server revalidation / no-op unchanged / parity/cascade / no partial side effect] |
+| Unknown semantics | [open questions to become GAPs] |
+
 Sibling Candidate Table: _(required when Phase 0.5 ran; consumed by `/sp-plan`)_
 | Candidate | Operation | Evidence | Confidence | Obligation |
 |---|---|---|---|---|
@@ -817,6 +846,7 @@ Self-check before writing the output file:
 - [ ] Input validation is clear for every user-facing field
 - [ ] Permissions are clear for every relevant role
 - [ ] If multi-role: cross-role flow confirmed, including timeouts and conflicts
+- [ ] If Phase 0.5 ran: Core Function Model is filled with operation, inputs, entry points, seams, contracts, invariants, and unknown semantics
 - [ ] If stateful / role-sensitive / multi-surface: Behavior Matrix discovery axes are filled with States, Viewers, Surfaces, and CREATE/READ pair map
 - [ ] If existing-operation or bug-fix discovery ran: Sibling Candidate Table lists every high/medium candidate with cover / GAP / ignore(reason)
 - [ ] UI expectation confirmed — dev team has no room to improvise

package/templates/skills/sp-explore-behavior-matrix/SKILL.md

@@ -141,14 +141,31 @@ Also note the **project domain** from CLAUDE.md (payment, booking, content, heal
 
 ---
 
-## Phase 0.5 — Sibling Discovery Pass (candidate only)
+## Phase 0.5 — Core Function Discovery (candidate only)
 
-Run this after Phase 0 when the feature changes an existing operation, fixes a bug, or touches state/viewer/surface behavior. Purpose: find sibling entry-points that perform the same domain operation but may not be named in the ticket.
+Run this after Phase 0 when the feature changes an existing operation, fixes a bug, touches state/viewer/surface behavior, or integrates with an external provider. Purpose: model the core operation before asking or planning, so later AS/GAP/BM work is driven by the actual function, entry points, seams, and contracts.
 
-This pass produces candidates, not requirements. A candidate may become a confirmed surface only after the user/spec/code evidence supports it. Do not auto-promote noisy matches into acceptance scenarios.
+This pass produces candidates and evidence, not requirements. A candidate may become a confirmed surface/contract only after the user/spec/code evidence supports it. Do not auto-promote noisy matches into acceptance scenarios.
 
 **Inputs:** raw symptom text, feature nouns, touched component/module, existing code hits from Phase 0, matching project-local `docs/invariants/INV-*.md` entries, and any shared anchors/constants already found.
 
+### Core Function Model
+
+Record the model first:
+
+| Field | Evidence |
+|---|---|
+| Operation | `<create subscription / validate coupon / create appointment / send invite / etc.>` |
+| Inputs | required / optional / absent inputs; identify no-op/omitted-input behavior |
+| Entry points | UI/API/job/webhook/provider callback surfaces that can invoke the operation |
+| Internal seams | route -> service/helper -> provider/db/cache/read-model; include injected/test seams |
+| External contracts | provider/API semantics, IDs, lifecycle timing, retries, trial/deferred effects |
+| State/surface axes | lifecycle/viewer/surface axes if triggered; otherwise `N/A: stateless` |
+| Invariants | fail-closed, server revalidation, no-op unchanged, parity/cascade, no partial side effect |
+| Unknown semantics | must become open questions/GAPs; do not guess provider behavior |
+
+### Entry-point / sibling discovery
+
 **Deterministic recipe:**
 
 1. **Seed nouns and verbs:** extract 3-8 terms such as domain object (`appointment`, `invite`, `matchup`), operation (`create`, `reschedule`, `cancel`, `send`), and surface nouns (`outreach`, `modal`, `guide`, `calendar`, `queue`).
@@ -157,7 +174,7 @@ This pass produces candidates, not requirements. A candidate may become a confir
 4. **Git change-coupling:** inspect recent co-change around seed files with `git log --name-only -- <seed-file>` and look for files/functions repeatedly changed with the seed. This is recall-oriented evidence, not proof.
 5. **GA blast radius if available:** use `ga_impact` for touched symbols/files to find connected blast radius, but do not treat importers-only output as complete sibling discovery. Siblings may be co-changed or share anchors without importing each other.
 
-Record every plausible sibling in a table:
+Record every plausible entry point / sibling in a table:
 
 | Candidate | Operation | Evidence | Confidence | Obligation |
 |---|---|---|---|---|
@@ -172,7 +189,7 @@ Rules:
 - `GAP`: candidate seems material but expected behavior/scope is unknown.
 - `ignore(reason)`: candidate is false positive or intentionally out of scope.
 
-Exit condition: every high/medium candidate has `cover`, `GAP`, or `ignore(reason)`. Low-confidence candidates can be listed as notes and do not block handoff.
+Exit condition: the Core Function Model is filled for every triggered field, and every high/medium entry-point candidate has `cover`, `GAP-NNN`, or `ignore(reason)`. Low-confidence candidates can be listed as notes and do not block handoff.
 
 ---
 
@@ -719,6 +736,18 @@ Timeout: [if role B does not act within X hours then...]
 
 **Behavior Matrix discovery axes:** _(required for stateful / role-sensitive / multi-surface features; consumed by `/sp-plan`)_
 
+Core Function Model: _(required when Phase 0.5 ran; consumed by `/sp-plan`)_
+| Field | Evidence |
+|---|---|
+| Operation | [core operation being changed] |
+| Inputs | [required / optional / absent inputs + no-op behavior] |
+| Entry points | [UI/API/job/webhook/provider callbacks] |
+| Internal seams | [route -> service/helper -> provider/db/cache/read-model; include test seam] |
+| External contracts | [provider semantics / lifecycle / retries / trial/deferred effects, or N/A] |
+| State/surface axes | [states/viewers/surfaces triggered, or N/A with reason] |
+| Invariants | [fail-closed / server revalidation / no-op unchanged / parity/cascade / no partial side effect] |
+| Unknown semantics | [open questions to become GAPs] |
+
 Sibling Candidate Table: _(required when Phase 0.5 ran; consumed by `/sp-plan`)_
 | Candidate | Operation | Evidence | Confidence | Obligation |
 |---|---|---|---|---|
@@ -817,6 +846,7 @@ Self-check before writing the output file:
 - [ ] Input validation is clear for every user-facing field
 - [ ] Permissions are clear for every relevant role
 - [ ] If multi-role: cross-role flow confirmed, including timeouts and conflicts
+- [ ] If Phase 0.5 ran: Core Function Model is filled with operation, inputs, entry points, seams, contracts, invariants, and unknown semantics
 - [ ] If stateful / role-sensitive / multi-surface: Behavior Matrix discovery axes are filled with States, Viewers, Surfaces, and CREATE/READ pair map
 - [ ] If existing-operation or bug-fix discovery ran: Sibling Candidate Table lists every high/medium candidate with cover / GAP / ignore(reason)
 - [ ] UI expectation confirmed — dev team has no room to improvise

package/templates/skills/sp-fix/SKILL.md

@@ -83,6 +83,20 @@ Use the invariant registry README/schema as base knowledge; README examples are
 - `candidate` → use as an investigation hint; do not treat it as a hard build requirement unless the bug confirms it.
 - `retired` → ignore unless this fix reintroduces the retired component.
 
+**Core Function Mapping (required before fix):** Map the bug to the operation it breaks before writing the failing test.
+
+| Field | Evidence |
+|---|---|
+| Operation | core create/update/delete/send/read/validate/charge/auth operation |
+| Inputs | required / optional / absent inputs involved in the bug |
+| Entry points | UI/API/job/webhook/provider callback surfaces that can invoke the operation |
+| Internal seams | route -> service/helper -> provider/db/cache/read-model boundary; include test seam |
+| External contracts | provider/API semantics, IDs, lifecycle timing, retries, trial/deferred effects, or N/A |
+| Invariants | fail-closed / server revalidation / no-op unchanged / parity/cascade / no partial side effect |
+| Unknown semantics | spec GAP or investigation question; do not guess |
+
+For provider/external/payment/auth/data mutation bugs, identify the public entry → service/helper → provider/db/cache boundary and decide what must be tested. Do not jump from symptom to one-line fix before this mapping.
+
 **Sibling Discovery Pass (candidate only):** Run this for lifecycle/parity/cascade bugs, existing-operation fixes, or any bug whose symptom names one surface but the operation may exist on sibling entry-points. This is the same recipe as `/sp-explore` Phase 0.5, scoped to the bug:
 
 1. Seed nouns/verbs from the raw symptom, failing test, touched component, and matching invariant entries.

package/templates/skills/sp-fix-behavior-matrix/SKILL.md

@@ -83,6 +83,20 @@ Use the invariant registry README/schema as base knowledge; README examples are
 - `candidate` → use as an investigation hint; do not treat it as a hard build requirement unless the bug confirms it.
 - `retired` → ignore unless this fix reintroduces the retired component.
 
+**Core Function Mapping (required before fix):** Map the bug to the operation it breaks before writing the failing test.
+
+| Field | Evidence |
+|---|---|
+| Operation | core create/update/delete/send/read/validate/charge/auth operation |
+| Inputs | required / optional / absent inputs involved in the bug |
+| Entry points | UI/API/job/webhook/provider callback surfaces that can invoke the operation |
+| Internal seams | route -> service/helper -> provider/db/cache/read-model boundary; include test seam |
+| External contracts | provider/API semantics, IDs, lifecycle timing, retries, trial/deferred effects, or N/A |
+| Invariants | fail-closed / server revalidation / no-op unchanged / parity/cascade / no partial side effect |
+| Unknown semantics | spec GAP or investigation question; do not guess |
+
+For provider/external/payment/auth/data mutation bugs, identify the public entry → service/helper → provider/db/cache boundary and decide what must be tested. Do not jump from symptom to one-line fix before this mapping.
+
 **Sibling Discovery Pass (candidate only):** Run this for lifecycle/parity/cascade bugs, existing-operation fixes, or any bug whose symptom names one surface but the operation may exist on sibling entry-points. This is the same recipe as `/sp-explore` Phase 0.5, scoped to the bug:
 
 1. Seed nouns/verbs from the raw symptom, failing test, touched component, and matching invariant entries.

package/templates/skills/sp-investigate/SKILL.md

@@ -134,13 +134,33 @@ Invariant match: <INV/C id + status | invariant text | none | no registry found>
 
 If no spec or invariant registry exists, continue. Do not invent one during investigation; report the absence as a gap if it matters. If the bug confirms a repeated lifecycle/parity/cascade rule, end the report with `Invariant action needed: add/update invariant: ...`.
 
+### 1.55 — Core Function Mapping
+
+Run this before Sibling Discovery when the report touches an existing operation, provider/external contract, payment/auth/data mutation, optional input, stateful flow, or cross-surface inconsistency.
+
+Purpose: define the operation and seams being investigated so blast radius and root cause do not collapse to the first file that matched the symptom.
+
+Record the model in the investigation output:
+
+| Field | Evidence |
+|---|---|
+| Operation | core create/update/delete/send/read/validate/charge/auth operation |
+| Inputs | required / optional / absent inputs involved |
+| Entry points | UI/API/job/webhook/provider callback surfaces |
+| Internal seams | route -> service/helper -> provider/db/cache/read-model boundary; include test seam |
+| External contracts | provider/API semantics, IDs, lifecycle timing, retries, trial/deferred effects, or N/A |
+| Invariants | fail-closed / server revalidation / no-op unchanged / parity/cascade / no partial side effect |
+| Unknown semantics | open question or spec GAP; do not guess |
+
+For external providers, separate facts verified in code/docs from assumptions. Unknown provider semantics become investigation gaps.
+
 ### 1.6 — Sibling Discovery Pass (candidate only)
 
 Run this for lifecycle/parity/cascade bugs, existing-operation investigations, or any report whose symptom names one surface but the operation may exist on sibling entry-points.
 
 Purpose: diagnose blast radius before deciding root cause. This produces candidates, not requirements or fixes.
 
-1. Seed nouns/verbs from the raw symptom, touched component, related spec/BM context, and matching invariant entries.
+1. Seed nouns/verbs from the raw symptom, Core Function Mapping, touched component, related spec/BM context, and matching invariant entries.
 2. Find shared-anchor callers (`ga_callers` if GA is available; otherwise grep) for helpers/constants/schemas that define the operation.
 3. Fuzzy-search parallel names such as `create_from_*`, `*_from_<source>`, `send_*invite*`, `*_outcome*`, `reschedule*`, `book_next*`, `cancel*`, `delete*`, plus domain verbs from the symptom.
 4. Inspect recent git co-change around touched files (`git log --name-only -- <seed-file>`) for repeatedly paired files/functions.
@@ -613,6 +633,14 @@ HYPOTHESIS A (PRIMARY — <confidence>)
   Location:     <file:line>
   Mechanism:    <what is wrong>
   Chain:        <cause> → <step> → ... → <symptom>
+  Core Function Model:
+    Operation:          <core operation>
+    Inputs:             <required / optional / absent inputs involved>
+    Entry points:       <UI/API/job/webhook/provider callback surfaces>
+    Internal seams:     <route -> service/helper -> provider/db/cache/read-model>
+    External contracts: <provider/API semantics or N/A>
+    Invariants:         <fail-closed / server revalidation / no-op unchanged / parity/cascade / no partial side effect>
+    Unknown semantics:  <open question / GAP / none>
   Behavior Matrix:
     State/status: <state or transition>
     Viewer/role:  <viewer/relationship>

package/templates/skills/sp-investigate-behavior-matrix/SKILL.md

@@ -134,13 +134,33 @@ Invariant match: <INV/C id + status | invariant text | none | no registry found>
 
 If no spec or invariant registry exists, continue. Do not invent one during investigation; report the absence as a gap if it matters. If the bug confirms a repeated lifecycle/parity/cascade rule, end the report with `Invariant action needed: add/update invariant: ...`.
 
+### 1.55 — Core Function Mapping
+
+Run this before Sibling Discovery when the report touches an existing operation, provider/external contract, payment/auth/data mutation, optional input, stateful flow, or cross-surface inconsistency.
+
+Purpose: define the operation and seams being investigated so blast radius and root cause do not collapse to the first file that matched the symptom.
+
+Record the model in the investigation output:
+
+| Field | Evidence |
+|---|---|
+| Operation | core create/update/delete/send/read/validate/charge/auth operation |
+| Inputs | required / optional / absent inputs involved |
+| Entry points | UI/API/job/webhook/provider callback surfaces |
+| Internal seams | route -> service/helper -> provider/db/cache/read-model boundary; include test seam |
+| External contracts | provider/API semantics, IDs, lifecycle timing, retries, trial/deferred effects, or N/A |
+| Invariants | fail-closed / server revalidation / no-op unchanged / parity/cascade / no partial side effect |
+| Unknown semantics | open question or spec GAP; do not guess |
+
+For external providers, separate facts verified in code/docs from assumptions. Unknown provider semantics become investigation gaps.
+
 ### 1.6 — Sibling Discovery Pass (candidate only)
 
 Run this for lifecycle/parity/cascade bugs, existing-operation investigations, or any report whose symptom names one surface but the operation may exist on sibling entry-points.
 
 Purpose: diagnose blast radius before deciding root cause. This produces candidates, not requirements or fixes.
 
-1. Seed nouns/verbs from the raw symptom, touched component, related spec/BM context, and matching invariant entries.
+1. Seed nouns/verbs from the raw symptom, Core Function Mapping, touched component, related spec/BM context, and matching invariant entries.
 2. Find shared-anchor callers (`ga_callers` if GA is available; otherwise grep) for helpers/constants/schemas that define the operation.
 3. Fuzzy-search parallel names such as `create_from_*`, `*_from_<source>`, `send_*invite*`, `*_outcome*`, `reschedule*`, `book_next*`, `cancel*`, `delete*`, plus domain verbs from the symptom.
 4. Inspect recent git co-change around touched files (`git log --name-only -- <seed-file>`) for repeatedly paired files/functions.
@@ -613,6 +633,14 @@ HYPOTHESIS A (PRIMARY — <confidence>)
   Location:     <file:line>
   Mechanism:    <what is wrong>
   Chain:        <cause> → <step> → ... → <symptom>
+  Core Function Model:
+    Operation:          <core operation>
+    Inputs:             <required / optional / absent inputs involved>
+    Entry points:       <UI/API/job/webhook/provider callback surfaces>
+    Internal seams:     <route -> service/helper -> provider/db/cache/read-model>
+    External contracts: <provider/API semantics or N/A>
+    Invariants:         <fail-closed / server revalidation / no-op unchanged / parity/cascade / no partial side effect>
+    Unknown semantics:  <open question / GAP / none>
   Behavior Matrix:
     State/status: <state or transition>
     Viewer/role:  <viewer/relationship>

package/templates/skills/sp-plan/SKILL.md

@@ -109,7 +109,8 @@ Before writing anything, run this checklist:
 | P0-2 | **Related specs** | List `docs/specs/` directories. Read the main spec of any related feature. Is there overlap? |
 | P0-2b | **Explore doc** | Derive feature name from `$ARGUMENTS` as kebab-case (same convention as `docs/specs/<feature>/`). Check `docs/explore/<feature-name>.md`. If no exact match, list `docs/explore/` and fuzzy-match by keywords. If found → read it. Log: "Explore findings found for '<feature>' — using as primary input. Skipping P0-3, P0-4 (already covered)." Continue with P0-5, P0-6. Full field-to-section mapping + Mode A/B/C scope: see **Explore → Spec mapping** subsection right after this table. |
 | P0-2c | **Invariant registry** | Use the invariant registry README/schema as base knowledge; README examples are not runtime entries. Then read matching project-local entries under `docs/invariants/INV-*.md` when their `component_keys`, `sibling_set`, `shared_anchor`, title, or origin bugs match the feature. Carry `confirmed`/`enforced` invariants into `## Constraints & Invariants`; treat `candidate` entries as risk notes or confirmation GAPs, not automatic requirements. |
-| P0-2d | **Sibling discovery** | If the feature changes an existing operation or fixes a bug, run the same candidate-only recipe as `/sp-explore` Phase 0.5 unless an explore doc already provides a Sibling Candidate Table. Sources: raw symptom/feature nouns, project-local invariants, shared anchors (`ga_callers` or grep), fuzzy sibling names (`create_from_*`, `*_from_*`, `send_*invite*`, `*_outcome*`, `reschedule*`, `book_next*`, etc.), and recent git co-change. Output feeds `## Sibling Candidate Table`; high/medium candidates must be `cover`, `GAP-NNN`, or `ignore(reason)`. Candidates do not become requirements until confirmed. |
+| P0-2d | **Core Function Model** | If the feature changes an operation, optional input, external/provider contract, payment/auth/data mutation, stateful flow, or bug-fix path, build or refresh `## Core Function Model` before stories. Use code evidence, related specs, explore handoff, project-local invariants, and provider semantics already present in repo/docs. Verify every file:line/symbol/config claim against code. Unknown provider semantics become `GAP-NNN`; do not guess. |
+| P0-2e | **Entry-point / sibling discovery** | If the Core Function Model shows multiple entry points, or the feature changes an existing operation/fix path, run the same candidate-only recipe as `/sp-explore` Phase 0.5 unless an explore doc already provides a Sibling Candidate Table. Sources: raw symptom/feature nouns, project-local invariants, shared anchors (`ga_callers` or grep), fuzzy sibling names (`create_from_*`, `*_from_*`, `send_*invite*`, `*_outcome*`, `reschedule*`, `book_next*`, etc.), and recent git co-change. Output feeds `## Sibling Candidate Table`; high/medium candidates must be `cover`, `GAP-NNN`, or `ignore(reason)`. Candidates do not become requirements until confirmed. |
 | P0-3 | **Dependency scan** | `ga_architecture` for the module map and `ga_importers` / `ga_callees` on touched symbols to see what this code reaches. Manual import-grep is a fallback. |
 | P0-4 | **Reusable utilities** | `ga_symbols` (fuzzy match) on names like `validate`, `format`, `parse`, `<domain>Helper` to find existing helpers; `ga_hubs` to surface the most-connected utilities worth reusing. |
 | P0-5 | **Project patterns** | Identify test framework, naming conventions, directory structure from existing code. |
@@ -412,8 +413,31 @@ point to a `GAP-NNN`. See Phase 1 §"Linked fields — pin cross-spec contracts
 - `<field>` — consumed by `<sibling>:AS-NNN` on <surface> (<persisted+served | transient-in-response>).
   Produced by `<sibling>:AS-NNN` on <surface>. ✔ match. | ✘ <surface|lifecycle> mismatch → GAP-NNN.]
 
+## Core Function Model
+[OPTIONAL — required when P0-2d ran or the explore handoff includes a Core Function Model.
+
+Purpose: model the operation before AS/BM/GAP so code seams, optional inputs, and provider contracts
+are not lost while writing acceptance scenarios.
+
+| Field | Evidence |
+|---|---|
+| Operation | [core operation being changed] |
+| Inputs | [required / optional / absent inputs; no-op behavior] |
+| Entry points | [UI/API/job/webhook/provider callback surfaces] |
+| Internal seams | [route -> service/helper -> provider/db/cache/read-model; include injected/test seam] |
+| External contracts | [provider/API semantics, IDs, lifecycle timing, retries, trial/deferred effects, or N/A] |
+| State/surface axes | [states/viewers/surfaces triggered, or N/A with reason] |
+| Invariants | [fail-closed / server revalidation / no-op unchanged / parity/cascade / no partial side effect] |
+| Unknown semantics | [GAP-NNN links; do not guess] |
+
+Rules:
+- Every code reference in this model must be verified against the repo or marked unverified.
+- External/provider semantics that affect behavior must be AS if stated, or GAP if unknown.
+- Optional inputs must include the omitted-input regression behavior or a GAP.
+- This model is the source for Sibling Surface Map, Behavior Matrix, Constraints, provider-contract gaps, and code-seam test targets.]
+
 ## Sibling Surface Map
-[OPTIONAL — required when P0-2d or the explore handoff found sibling candidates.
+[OPTIONAL — required when P0-2e or the explore handoff found sibling candidates.
 
 Purpose: separate noisy discovery evidence from confirmed planning surfaces. The Candidate Table
 is evidence; the Confirmed Surface Map is what can feed `## Behavior Matrix`.
@@ -589,9 +613,11 @@ Two kinds of "missing", handled differently:
 - **Underspecified** — trigger present, outcome not stated → a **Gap** (`GAP-NNN`, see the Gaps section), not a guessed AS — and not an AS shell either: never write an AS whose Then is only "see GAP-NNN". If a minimal safe outcome IS assertable (e.g. "request refused, state unchanged"), write that as the AS and point to the Gap for the unspecified detail; if nothing concrete is assertable, it is a Gap alone. *Explore-doc case:* if a trigger appears in the description (Happy path / Edge cases / Permissions / Integration) but its outcome lives in the explore's `Open questions` or `Assumptions` rather than being stated, that is still Underspecified — emit `GAP-NNN (status: open)` with `Source:` quoting the explore phrase; do not invent an AS.
 - **Out of scope** — no trigger at all → emit nothing. Don't invent "what about concurrent edits?" when the text never mentions concurrency.
 
-**Cross-surface invariant pass (run after the atom list).** For every constraint stated as a system-wide rule (or carrying `scope:`/`surfaces:` in `## Constraints & Invariants`), enumerate EVERY story whose `When` can exercise it. Each such story binds it via `**Applies Constraints:**` and carries an AS asserting the invariant's OUTCOME at that surface. **For a stated cross-surface invariant the minimal-safe outcome (at-most-once: a repeat at this surface causes ≤1 effect) IS assertable** — it is the stated invariant applied to the surface, not a new requirement — so write the outcome AS; do NOT downgrade the whole surface to a bare Gap. If the surface's *mechanism* is unstated (e.g. a provider idempotency-key vs a server-side guard), attach a `GAP-NNN` from that AS for the mechanism detail — outcome asserted, mechanism deferred. A surface becomes a *bare* Gap (no AS) only when no minimal-safe outcome is assertable at all. This removes the AS-vs-Gap coin-flip: a money/effect surface under a stated invariant ALWAYS gets an outcome AS (+ a mechanism Gap if needed), never a bare Gap by default. This does NOT invent the invariant — it is already stated; it forces a stated invariant to be acknowledged at every surface it reaches, closing the "stated once, silently dropped at a second endpoint" hole (an idempotency rule that guarded one endpoint but not a second one — the class of bug this pass exists to kill). Still derive-or-Gap for any genuinely unstated outcome: never a guessed one.
+**Core Function Model pass (run before AS derivation when triggered).** If `## Core Function Model` exists or P0-2d triggers, derive AS/GAP/Constraints from each confirmed entry point, seam, external contract, invariant, optional/absent input, and unknown semantic. Provider/external features must include a verified seam from public entry to provider call/test seam. If the model names an optional input, include the absent-input regression or GAP. If provider semantics are unknown, write GAP — not AS. If a code reference cannot be verified, mark it unverified or remove it; do not leave fabricated file:line/symbol claims in the spec.
+
+**Cross-surface invariant pass (run after the atom list and Core Function Model pass).** For every constraint stated as a system-wide rule (or carrying `scope:`/`surfaces:` in `## Constraints & Invariants`), enumerate EVERY story whose `When` can exercise it. Each such story binds it via `**Applies Constraints:**` and carries an AS asserting the invariant's OUTCOME at that surface. **For a stated cross-surface invariant the minimal-safe outcome (at-most-once: a repeat at this surface causes ≤1 effect) IS assertable** — it is the stated invariant applied to the surface, not a new requirement — so write the outcome AS; do NOT downgrade the whole surface to a bare Gap. If the surface's *mechanism* is unstated (e.g. a provider idempotency-key vs a server-side guard), attach a `GAP-NNN` from that AS for the mechanism detail — outcome asserted, mechanism deferred. A surface becomes a *bare* Gap (no AS) only when no minimal-safe outcome is assertable at all. This removes the AS-vs-Gap coin-flip: a money/effect surface under a stated invariant ALWAYS gets an outcome AS (+ a mechanism Gap if needed), never a bare Gap by default. This does NOT invent the invariant — it is already stated; it forces a stated invariant to be acknowledged at every surface it reaches, closing the "stated once, silently dropped at a second endpoint" hole (an idempotency rule that guarded one endpoint but not a second one — the class of bug this pass exists to kill). Still derive-or-Gap for any genuinely unstated outcome: never a guessed one.
 
-**Sibling Surface Map pass (run before the Behavior Matrix pass).** If P0-2d or the explore handoff found sibling candidates, create `## Sibling Surface Map`. Treat discovery output as evidence, not a contract:
+**Sibling Surface Map pass (run before the Behavior Matrix pass).** If P0-2e or the explore handoff found sibling candidates, create `## Sibling Surface Map`. Treat discovery output as evidence, not a contract:
 - High/medium candidates require a disposition: `cover`, `GAP-NNN`, or `ignore(reason)`.
 - `cover` candidates become confirmed sibling surfaces and may feed Behavior Matrix surfaces.
 - `GAP-NNN` candidates do not become BM cells until clarified, but the gap must name what is unknown.
@@ -600,10 +626,10 @@ Two kinds of "missing", handled differently:
 
 This pass is the upstream discovery gate for sibling-drift bugs: first find plausible sibling entry-points, then deliberately confirm or park them. It must not manufacture requirements from fuzzy matches.
 
-**Behavior Matrix pass (run after the cross-surface invariant pass).** If the feature triggers any state/status/stage, viewer role, permission-dependent affordance, cross-module read/write path, or repeated read surface, create `## Behavior Matrix` before finalizing AS. Derive the axes only from the spec/explore/codebase scan:
+**Behavior Matrix pass (run after the Core Function Model and cross-surface invariant pass).** If the feature triggers any state/status/stage, viewer role, permission-dependent affordance, cross-module read/write path, or repeated read surface, create `## Behavior Matrix` before finalizing AS. Derive the axes only from the spec/explore/codebase scan:
 - States from the state machine or named lifecycle/status values.
 - Viewers from roles, owners/assignees, actor/recipient relationships, and permission rules.
-- Surfaces from confirmed sibling surfaces, Module Dependency Map style source/target pairs, UI pages, API read paths, notifications/email, calendar/provider surfaces, feeds, counts, and dashboards.
+- Surfaces from confirmed sibling surfaces, Core Function Model entry points/seams, Module Dependency Map style source/target pairs, UI pages, API read paths, notifications/email, calendar/provider surfaces, feeds, counts, and dashboards.
 
 For each material cell, either:
 - write an AS asserting the exact behavior for that state/viewer/surface, including label, visibility, allowed action, data source/timing, and cascade/parity obligations when applicable;
@@ -662,6 +688,7 @@ Include only sections that apply:
 | CC12 | If the feature triggers state/viewer/surface behavior, `## Behavior Matrix` exists and every material cell has `Coverage` = `AS-NNN`, `GAP-NNN`, or `N/A: <reason>`. No blank coverage cells. Every non-N/A cell maps to an existing AS/GAP; every `N/A` has a concrete reason. State-transition cells list cascade obligations or `none`; read-surface cells list source/timing/lifecycle | Add the matrix, fill the cells, bind each non-N/A cell to AS/GAP, or explain why the matrix is not applicable |
 | CC13 | Every matching `docs/invariants/INV-*.md` entry is handled according to status: `enforced` → referenced `test_ref` or equivalent regression is named in implementation guidance; `confirmed` → sibling/component coverage is represented by AS/GAP/N/A; `candidate` → confirmation GAP/risk note or explicit ignore reason; `retired` → ignored with reason if matched | Add invariant coverage, record a confirmation GAP/risk note, or explain why the invariant does not apply |
 | CC14 | If sibling discovery ran or the explore handoff includes a Sibling Candidate Table, every high/medium candidate has `cover`, `GAP-NNN`, or `ignore(reason)`. Only `cover` candidates feed `## Behavior Matrix`; `GAP`/`ignore` candidates do not create AS/BM requirements | Add the disposition, create the confirmation GAP, or remove the candidate with reason |
+| CC15 | If Core Function Model is required or present, it names operation, inputs, entry points, internal seams, external contracts or N/A, invariants, and unknown semantics. Every confirmed model item is represented by AS/GAP/Constraint/BM. Provider/external semantics that are unknown are GAPs; file:line/symbol/config claims are verified or marked unverified | Add/repair the model, verify references, or create the missing AS/GAP/Constraint/BM coverage |
 
 **CC5 enforcement procedure (mandatory, no exceptions):**
 1. Enumerate every `C-xxx` line in `## Constraints & Invariants`.
@@ -939,6 +966,7 @@ After updating, verify:
 | CC12 | If this run ADDS or MODIFIES state/viewer/surface behavior, the touched `## Behavior Matrix` cells exist and each has `Coverage` = `AS-NNN`, `GAP-NNN`, or `N/A: <reason>`. Untouched legacy matrix cells are not re-audited. If no matrix exists and this update introduces the trigger, add the matrix for the touched scope | Add/update the matrix cells and bind non-N/A cells to AS/GAP; do not ship a new state/viewer/surface path as prose only |
 | CC13 | If this run touches a component named by `docs/invariants/INV-*.md`, the matching invariant entry is handled by status (`enforced` test_ref/equivalent named; `confirmed` covered or GAP/N/A; `candidate` confirmation GAP/risk note; `retired` ignored with reason). Untouched unrelated invariants are not re-audited | Add/update invariant coverage or record the confirmation/risk disposition |
 | CC14 | If this Mode C update adds/modifies an existing operation or bug-fix path, sibling discovery has either run for the touched scope or a prior Sibling Surface Map is reused. High/medium candidates are disposed as `cover`, `GAP-NNN`, or `ignore(reason)`; only `cover` candidates feed new BM cells | Run sibling discovery for the touched scope, then update the Sibling Surface Map disposition |
+| CC15 | If this Mode C update changes an operation/input/provider seam/external contract, Core Function Model is updated for the touched scope and confirmed model entries are covered by AS/GAP/Constraint/BM. New or changed file:line/symbol/config claims are verified or marked unverified | Update the model, verify references, and add missing coverage or GAP |
 
 > **⛔ Consistency check is NOT optional.**
 > Run CC1-CC6 after EVERY update (Major and Minor).

package/templates/skills/sp-plan-behavior-matrix/SKILL.md

@@ -109,7 +109,8 @@ Before writing anything, run this checklist:
 | P0-2 | **Related specs** | List `docs/specs/` directories. Read the main spec of any related feature. Is there overlap? |
 | P0-2b | **Explore doc** | Derive feature name from `$ARGUMENTS` as kebab-case (same convention as `docs/specs/<feature>/`). Check `docs/explore/<feature-name>.md`. If no exact match, list `docs/explore/` and fuzzy-match by keywords. If found → read it. Log: "Explore findings found for '<feature>' — using as primary input. Skipping P0-3, P0-4 (already covered)." Continue with P0-5, P0-6. Full field-to-section mapping + Mode A/B/C scope: see **Explore → Spec mapping** subsection right after this table. |
 | P0-2c | **Invariant registry** | Use the invariant registry README/schema as base knowledge; README examples are not runtime entries. Then read matching project-local entries under `docs/invariants/INV-*.md` when their `component_keys`, `sibling_set`, `shared_anchor`, title, or origin bugs match the feature. Carry `confirmed`/`enforced` invariants into `## Constraints & Invariants`; treat `candidate` entries as risk notes or confirmation GAPs, not automatic requirements. |
-| P0-2d | **Sibling discovery** | If the feature changes an existing operation or fixes a bug, run the same candidate-only recipe as `/sp-explore` Phase 0.5 unless an explore doc already provides a Sibling Candidate Table. Sources: raw symptom/feature nouns, project-local invariants, shared anchors (`ga_callers` or grep), fuzzy sibling names (`create_from_*`, `*_from_*`, `send_*invite*`, `*_outcome*`, `reschedule*`, `book_next*`, etc.), and recent git co-change. Output feeds `## Sibling Candidate Table`; high/medium candidates must be `cover`, `GAP-NNN`, or `ignore(reason)`. Candidates do not become requirements until confirmed. |
+| P0-2d | **Core Function Model** | If the feature changes an operation, optional input, external/provider contract, payment/auth/data mutation, stateful flow, or bug-fix path, build or refresh `## Core Function Model` before stories. Use code evidence, related specs, explore handoff, project-local invariants, and provider semantics already present in repo/docs. Verify every file:line/symbol/config claim against code. Unknown provider semantics become `GAP-NNN`; do not guess. |
+| P0-2e | **Entry-point / sibling discovery** | If the Core Function Model shows multiple entry points, or the feature changes an existing operation/fix path, run the same candidate-only recipe as `/sp-explore` Phase 0.5 unless an explore doc already provides a Sibling Candidate Table. Sources: raw symptom/feature nouns, project-local invariants, shared anchors (`ga_callers` or grep), fuzzy sibling names (`create_from_*`, `*_from_*`, `send_*invite*`, `*_outcome*`, `reschedule*`, `book_next*`, etc.), and recent git co-change. Output feeds `## Sibling Candidate Table`; high/medium candidates must be `cover`, `GAP-NNN`, or `ignore(reason)`. Candidates do not become requirements until confirmed. |
 | P0-3 | **Dependency scan** | `ga_architecture` for the module map and `ga_importers` / `ga_callees` on touched symbols to see what this code reaches. Manual import-grep is a fallback. |
 | P0-4 | **Reusable utilities** | `ga_symbols` (fuzzy match) on names like `validate`, `format`, `parse`, `<domain>Helper` to find existing helpers; `ga_hubs` to surface the most-connected utilities worth reusing. |
 | P0-5 | **Project patterns** | Identify test framework, naming conventions, directory structure from existing code. |
@@ -412,8 +413,31 @@ point to a `GAP-NNN`. See Phase 1 §"Linked fields — pin cross-spec contracts
 - `<field>` — consumed by `<sibling>:AS-NNN` on <surface> (<persisted+served | transient-in-response>).
   Produced by `<sibling>:AS-NNN` on <surface>. ✔ match. | ✘ <surface|lifecycle> mismatch → GAP-NNN.]
 
+## Core Function Model
+[OPTIONAL — required when P0-2d ran or the explore handoff includes a Core Function Model.
+
+Purpose: model the operation before AS/BM/GAP so code seams, optional inputs, and provider contracts
+are not lost while writing acceptance scenarios.
+
+| Field | Evidence |
+|---|---|
+| Operation | [core operation being changed] |
+| Inputs | [required / optional / absent inputs; no-op behavior] |
+| Entry points | [UI/API/job/webhook/provider callback surfaces] |
+| Internal seams | [route -> service/helper -> provider/db/cache/read-model; include injected/test seam] |
+| External contracts | [provider/API semantics, IDs, lifecycle timing, retries, trial/deferred effects, or N/A] |
+| State/surface axes | [states/viewers/surfaces triggered, or N/A with reason] |
+| Invariants | [fail-closed / server revalidation / no-op unchanged / parity/cascade / no partial side effect] |
+| Unknown semantics | [GAP-NNN links; do not guess] |
+
+Rules:
+- Every code reference in this model must be verified against the repo or marked unverified.
+- External/provider semantics that affect behavior must be AS if stated, or GAP if unknown.
+- Optional inputs must include the omitted-input regression behavior or a GAP.
+- This model is the source for Sibling Surface Map, Behavior Matrix, Constraints, provider-contract gaps, and code-seam test targets.]
+
 ## Sibling Surface Map
-[OPTIONAL — required when P0-2d or the explore handoff found sibling candidates.
+[OPTIONAL — required when P0-2e or the explore handoff found sibling candidates.
 
 Purpose: separate noisy discovery evidence from confirmed planning surfaces. The Candidate Table
 is evidence; the Confirmed Surface Map is what can feed `## Behavior Matrix`.
@@ -589,9 +613,11 @@ Two kinds of "missing", handled differently:
 - **Underspecified** — trigger present, outcome not stated → a **Gap** (`GAP-NNN`, see the Gaps section), not a guessed AS — and not an AS shell either: never write an AS whose Then is only "see GAP-NNN". If a minimal safe outcome IS assertable (e.g. "request refused, state unchanged"), write that as the AS and point to the Gap for the unspecified detail; if nothing concrete is assertable, it is a Gap alone. *Explore-doc case:* if a trigger appears in the description (Happy path / Edge cases / Permissions / Integration) but its outcome lives in the explore's `Open questions` or `Assumptions` rather than being stated, that is still Underspecified — emit `GAP-NNN (status: open)` with `Source:` quoting the explore phrase; do not invent an AS.
 - **Out of scope** — no trigger at all → emit nothing. Don't invent "what about concurrent edits?" when the text never mentions concurrency.
 
-**Cross-surface invariant pass (run after the atom list).** For every constraint stated as a system-wide rule (or carrying `scope:`/`surfaces:` in `## Constraints & Invariants`), enumerate EVERY story whose `When` can exercise it. Each such story binds it via `**Applies Constraints:**` and carries an AS asserting the invariant's OUTCOME at that surface. **For a stated cross-surface invariant the minimal-safe outcome (at-most-once: a repeat at this surface causes ≤1 effect) IS assertable** — it is the stated invariant applied to the surface, not a new requirement — so write the outcome AS; do NOT downgrade the whole surface to a bare Gap. If the surface's *mechanism* is unstated (e.g. a provider idempotency-key vs a server-side guard), attach a `GAP-NNN` from that AS for the mechanism detail — outcome asserted, mechanism deferred. A surface becomes a *bare* Gap (no AS) only when no minimal-safe outcome is assertable at all. This removes the AS-vs-Gap coin-flip: a money/effect surface under a stated invariant ALWAYS gets an outcome AS (+ a mechanism Gap if needed), never a bare Gap by default. This does NOT invent the invariant — it is already stated; it forces a stated invariant to be acknowledged at every surface it reaches, closing the "stated once, silently dropped at a second endpoint" hole (an idempotency rule that guarded one endpoint but not a second one — the class of bug this pass exists to kill). Still derive-or-Gap for any genuinely unstated outcome: never a guessed one.
+**Core Function Model pass (run before AS derivation when triggered).** If `## Core Function Model` exists or P0-2d triggers, derive AS/GAP/Constraints from each confirmed entry point, seam, external contract, invariant, optional/absent input, and unknown semantic. Provider/external features must include a verified seam from public entry to provider call/test seam. If the model names an optional input, include the absent-input regression or GAP. If provider semantics are unknown, write GAP — not AS. If a code reference cannot be verified, mark it unverified or remove it; do not leave fabricated file:line/symbol claims in the spec.
+
+**Cross-surface invariant pass (run after the atom list and Core Function Model pass).** For every constraint stated as a system-wide rule (or carrying `scope:`/`surfaces:` in `## Constraints & Invariants`), enumerate EVERY story whose `When` can exercise it. Each such story binds it via `**Applies Constraints:**` and carries an AS asserting the invariant's OUTCOME at that surface. **For a stated cross-surface invariant the minimal-safe outcome (at-most-once: a repeat at this surface causes ≤1 effect) IS assertable** — it is the stated invariant applied to the surface, not a new requirement — so write the outcome AS; do NOT downgrade the whole surface to a bare Gap. If the surface's *mechanism* is unstated (e.g. a provider idempotency-key vs a server-side guard), attach a `GAP-NNN` from that AS for the mechanism detail — outcome asserted, mechanism deferred. A surface becomes a *bare* Gap (no AS) only when no minimal-safe outcome is assertable at all. This removes the AS-vs-Gap coin-flip: a money/effect surface under a stated invariant ALWAYS gets an outcome AS (+ a mechanism Gap if needed), never a bare Gap by default. This does NOT invent the invariant — it is already stated; it forces a stated invariant to be acknowledged at every surface it reaches, closing the "stated once, silently dropped at a second endpoint" hole (an idempotency rule that guarded one endpoint but not a second one — the class of bug this pass exists to kill). Still derive-or-Gap for any genuinely unstated outcome: never a guessed one.
 
-**Sibling Surface Map pass (run before the Behavior Matrix pass).** If P0-2d or the explore handoff found sibling candidates, create `## Sibling Surface Map`. Treat discovery output as evidence, not a contract:
+**Sibling Surface Map pass (run before the Behavior Matrix pass).** If P0-2e or the explore handoff found sibling candidates, create `## Sibling Surface Map`. Treat discovery output as evidence, not a contract:
 - High/medium candidates require a disposition: `cover`, `GAP-NNN`, or `ignore(reason)`.
 - `cover` candidates become confirmed sibling surfaces and may feed Behavior Matrix surfaces.
 - `GAP-NNN` candidates do not become BM cells until clarified, but the gap must name what is unknown.
@@ -600,10 +626,10 @@ Two kinds of "missing", handled differently:
 
 This pass is the upstream discovery gate for sibling-drift bugs: first find plausible sibling entry-points, then deliberately confirm or park them. It must not manufacture requirements from fuzzy matches.
 
-**Behavior Matrix pass (run after the cross-surface invariant pass).** If the feature triggers any state/status/stage, viewer role, permission-dependent affordance, cross-module read/write path, or repeated read surface, create `## Behavior Matrix` before finalizing AS. Derive the axes only from the spec/explore/codebase scan:
+**Behavior Matrix pass (run after the Core Function Model and cross-surface invariant pass).** If the feature triggers any state/status/stage, viewer role, permission-dependent affordance, cross-module read/write path, or repeated read surface, create `## Behavior Matrix` before finalizing AS. Derive the axes only from the spec/explore/codebase scan:
 - States from the state machine or named lifecycle/status values.
 - Viewers from roles, owners/assignees, actor/recipient relationships, and permission rules.
-- Surfaces from confirmed sibling surfaces, Module Dependency Map style source/target pairs, UI pages, API read paths, notifications/email, calendar/provider surfaces, feeds, counts, and dashboards.
+- Surfaces from confirmed sibling surfaces, Core Function Model entry points/seams, Module Dependency Map style source/target pairs, UI pages, API read paths, notifications/email, calendar/provider surfaces, feeds, counts, and dashboards.
 
 For each material cell, either:
 - write an AS asserting the exact behavior for that state/viewer/surface, including label, visibility, allowed action, data source/timing, and cascade/parity obligations when applicable;
@@ -662,6 +688,7 @@ Include only sections that apply:
 | CC12 | If the feature triggers state/viewer/surface behavior, `## Behavior Matrix` exists and every material cell has `Coverage` = `AS-NNN`, `GAP-NNN`, or `N/A: <reason>`. No blank coverage cells. Every non-N/A cell maps to an existing AS/GAP; every `N/A` has a concrete reason. State-transition cells list cascade obligations or `none`; read-surface cells list source/timing/lifecycle | Add the matrix, fill the cells, bind each non-N/A cell to AS/GAP, or explain why the matrix is not applicable |
 | CC13 | Every matching `docs/invariants/INV-*.md` entry is handled according to status: `enforced` → referenced `test_ref` or equivalent regression is named in implementation guidance; `confirmed` → sibling/component coverage is represented by AS/GAP/N/A; `candidate` → confirmation GAP/risk note or explicit ignore reason; `retired` → ignored with reason if matched | Add invariant coverage, record a confirmation GAP/risk note, or explain why the invariant does not apply |
 | CC14 | If sibling discovery ran or the explore handoff includes a Sibling Candidate Table, every high/medium candidate has `cover`, `GAP-NNN`, or `ignore(reason)`. Only `cover` candidates feed `## Behavior Matrix`; `GAP`/`ignore` candidates do not create AS/BM requirements | Add the disposition, create the confirmation GAP, or remove the candidate with reason |
+| CC15 | If Core Function Model is required or present, it names operation, inputs, entry points, internal seams, external contracts or N/A, invariants, and unknown semantics. Every confirmed model item is represented by AS/GAP/Constraint/BM. Provider/external semantics that are unknown are GAPs; file:line/symbol/config claims are verified or marked unverified | Add/repair the model, verify references, or create the missing AS/GAP/Constraint/BM coverage |
 
 **CC5 enforcement procedure (mandatory, no exceptions):**
 1. Enumerate every `C-xxx` line in `## Constraints & Invariants`.
@@ -939,6 +966,7 @@ After updating, verify:
 | CC12 | If this run ADDS or MODIFIES state/viewer/surface behavior, the touched `## Behavior Matrix` cells exist and each has `Coverage` = `AS-NNN`, `GAP-NNN`, or `N/A: <reason>`. Untouched legacy matrix cells are not re-audited. If no matrix exists and this update introduces the trigger, add the matrix for the touched scope | Add/update the matrix cells and bind non-N/A cells to AS/GAP; do not ship a new state/viewer/surface path as prose only |
 | CC13 | If this run touches a component named by `docs/invariants/INV-*.md`, the matching invariant entry is handled by status (`enforced` test_ref/equivalent named; `confirmed` covered or GAP/N/A; `candidate` confirmation GAP/risk note; `retired` ignored with reason). Untouched unrelated invariants are not re-audited | Add/update invariant coverage or record the confirmation/risk disposition |
 | CC14 | If this Mode C update adds/modifies an existing operation or bug-fix path, sibling discovery has either run for the touched scope or a prior Sibling Surface Map is reused. High/medium candidates are disposed as `cover`, `GAP-NNN`, or `ignore(reason)`; only `cover` candidates feed new BM cells | Run sibling discovery for the touched scope, then update the Sibling Surface Map disposition |
+| CC15 | If this Mode C update changes an operation/input/provider seam/external contract, Core Function Model is updated for the touched scope and confirmed model entries are covered by AS/GAP/Constraint/BM. New or changed file:line/symbol/config claims are verified or marked unverified | Update the model, verify references, and add missing coverage or GAP |
 
 > **⛔ Consistency check is NOT optional.**
 > Run CC1-CC6 after EVERY update (Major and Minor).

package/templates/skills/sp-review/SKILL.md

@@ -101,8 +101,12 @@ Spend 60% of analysis on the primary focus. Cover all categories, but proportion
 
 ### Behavior Matrix & Invariants (High)
 
-Use this section when the spec has `## Behavior Matrix`, `## Sibling Surface Map`, or project-local invariant logs match the diff.
+Use this section when the spec has `## Core Function Model`, `## Behavior Matrix`, `## Sibling Surface Map`, or project-local invariant logs match the diff.
 
+- **Core model trace:** For each changed operation, input, entry point, seam, provider contract, or external side effect, identify the corresponding `## Core Function Model` row. If the diff changes provider/payment/auth/data semantics and no AS/GAP/Constraint/BM/test covers it, flag High.
+- **Optional-input regression:** If the diff adds or changes an optional input, omitted-input/no-op behavior must be covered by AS/GAP or a test. Flag missing absent-input regression coverage.
+- **Provider contract drift:** For external providers, verify typed IDs, lifecycle timing, retries/trials/webhooks, fail-closed behavior, and deferred-effect semantics are covered by AS/GAP/Constraint. Unknown provider semantics should be GAPs, not guessed AS.
+- **Reference accuracy:** If the spec cites file:line/symbol/config and the diff/code contradicts it, flag High/Medium depending on release risk. Stale or fabricated references are review findings, not harmless prose.
 - **Cell-to-diff trace:** For each changed state transition, viewer rule, read surface, notification, queue, dashboard count, feed, calendar, or API projection, identify the corresponding `BM.AS-NNN.<surface>` row. If code changes behavior for a matrix cell but tests do not reference that AS ID or `BM.AS-NNN`, flag High.
 - **Surface parity:** If the diff updates one read surface for a state/viewer change, check matrix siblings for list/detail/worklist/dashboard/feed/API/email/calendar parity. Flag missing sibling updates unless the matrix marks them `N/A` with a concrete reason.
 - **Sibling candidate disposition:** If the spec has `## Sibling Surface Map`, every high/medium candidate must be `cover`, `GAP-NNN`, or `ignore(reason)`. Flag missing dispositions. If the diff changes a confirmed sibling surface but omits sibling tests/updates for the other confirmed surfaces, flag High unless a GAP/N/A covers it.

package/templates/skills/sp-review-behavior-matrix/SKILL.md

@@ -101,8 +101,12 @@ Spend 60% of analysis on the primary focus. Cover all categories, but proportion
 
 ### Behavior Matrix & Invariants (High)
 
-Use this section when the spec has `## Behavior Matrix`, `## Sibling Surface Map`, or project-local invariant logs match the diff.
+Use this section when the spec has `## Core Function Model`, `## Behavior Matrix`, `## Sibling Surface Map`, or project-local invariant logs match the diff.
 
+- **Core model trace:** For each changed operation, input, entry point, seam, provider contract, or external side effect, identify the corresponding `## Core Function Model` row. If the diff changes provider/payment/auth/data semantics and no AS/GAP/Constraint/BM/test covers it, flag High.
+- **Optional-input regression:** If the diff adds or changes an optional input, omitted-input/no-op behavior must be covered by AS/GAP or a test. Flag missing absent-input regression coverage.
+- **Provider contract drift:** For external providers, verify typed IDs, lifecycle timing, retries/trials/webhooks, fail-closed behavior, and deferred-effect semantics are covered by AS/GAP/Constraint. Unknown provider semantics should be GAPs, not guessed AS.
+- **Reference accuracy:** If the spec cites file:line/symbol/config and the diff/code contradicts it, flag High/Medium depending on release risk. Stale or fabricated references are review findings, not harmless prose.
 - **Cell-to-diff trace:** For each changed state transition, viewer rule, read surface, notification, queue, dashboard count, feed, calendar, or API projection, identify the corresponding `BM.AS-NNN.<surface>` row. If code changes behavior for a matrix cell but tests do not reference that AS ID or `BM.AS-NNN`, flag High.
 - **Surface parity:** If the diff updates one read surface for a state/viewer change, check matrix siblings for list/detail/worklist/dashboard/feed/API/email/calendar parity. Flag missing sibling updates unless the matrix marks them `N/A` with a concrete reason.
 - **Sibling candidate disposition:** If the spec has `## Sibling Surface Map`, every high/medium candidate must be `cover`, `GAP-NNN`, or `ignore(reason)`. Flag missing dispositions. If the diff changes a confirmed sibling surface but omits sibling tests/updates for the other confirmed surfaces, flag High unless a GAP/N/A covers it.