universal-dev-standards 5.11.0 → 5.12.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bundled/ai/standards/acceptance-criteria-traceability.ai.yaml +10 -4
- package/bundled/ai/standards/full-coverage-testing.ai.yaml +8 -1
- package/bundled/ai/standards/license-compliance.ai.yaml +379 -10
- package/bundled/ai/standards/test-governance.ai.yaml +19 -0
- package/bundled/core/license-compliance.md +118 -0
- package/bundled/locales/zh-CN/CHANGELOG.md +32 -3
- package/bundled/locales/zh-CN/README.md +1 -1
- package/bundled/locales/zh-TW/CHANGELOG.md +39 -3
- package/bundled/locales/zh-TW/README.md +1 -1
- package/bundled/skills/README.md +3 -0
- package/package.json +1 -1
- package/standards-registry.json +5 -4
|
@@ -61,11 +61,17 @@ standard:
|
|
|
61
61
|
|
|
62
62
|
- status: not_implemented
|
|
63
63
|
symbol: "🚫"
|
|
64
|
-
definition: AC has no corresponding implementation (feature code does not exist)
|
|
64
|
+
definition: AC has no corresponding implementation or test verification (feature code or test body does not exist)
|
|
65
65
|
criteria: |
|
|
66
|
-
No business logic in src/ corresponds to this AC
|
|
67
|
-
|
|
68
|
-
|
|
66
|
+
No business logic in src/ corresponds to this AC, OR the only test mapped
|
|
67
|
+
to this AC is an it.todo() placeholder (test body not implemented).
|
|
68
|
+
Distinct from uncovered: uncovered = code exists but test was forgotten;
|
|
69
|
+
not_implemented = explicitly marked as pending implementation.
|
|
70
|
+
Typical signals:
|
|
71
|
+
- throw NotImplementedException(), empty stub body, FEATURE_STUB: marker
|
|
72
|
+
- it.todo("AC-XXX: ...") — test slot reserved but verification not written
|
|
73
|
+
XSPEC-220: it.todo() tests map to not_implemented, NOT to uncovered.
|
|
74
|
+
Rationale: it.todo() is a deliberate placeholder, not an oversight.
|
|
69
75
|
decision_tree: |
|
|
70
76
|
Q1: Does the corresponding code exist in src/?
|
|
71
77
|
No → not_implemented
|
|
@@ -75,13 +75,20 @@ standard:
|
|
|
75
75
|
instruction: |
|
|
76
76
|
FORBIDDEN: Tautology assertions that always pass regardless of behavior.
|
|
77
77
|
These add false coverage without verifying anything.
|
|
78
|
+
AI SKELETON RULE (XSPEC-220): When generating unimplemented test skeletons,
|
|
79
|
+
use it.todo("AC-XXX: Given ... When ... Then ..."). Any it() callback whose
|
|
80
|
+
body contains only tautology assertions is an [ANTI-FAKE-001] violation,
|
|
81
|
+
regardless of whether the skeleton was generated by a human or an AI agent.
|
|
78
82
|
priority: required
|
|
79
83
|
forbidden_patterns:
|
|
80
84
|
- "expect(true).toBe(true)"
|
|
81
85
|
- "expect(false).toBe(false)"
|
|
82
86
|
- "expect(result).toBeDefined() // without specific value"
|
|
83
87
|
- "expect(result).not.toBeNull() // without specific value"
|
|
84
|
-
|
|
88
|
+
- "it('...', () => { expect(true).toBe(true) }) // AI-generated skeleton"
|
|
89
|
+
required_instead: |
|
|
90
|
+
Real assertion: expect(result).toBe(<specific expected value>)
|
|
91
|
+
Unimplemented skeleton: it.todo("AC-XXX: Given ... When ... Then ...")
|
|
85
92
|
|
|
86
93
|
- id: no-mock-business-logic
|
|
87
94
|
trigger: deciding what to mock
|
|
@@ -1,18 +1,102 @@
|
|
|
1
1
|
# License Compliance Standards - AI Optimized
|
|
2
|
-
#
|
|
2
|
+
# Sources:
|
|
3
|
+
# v1.0.0 — XSPEC-066 Wave 3 Compliance Pack (general OSS practices)
|
|
4
|
+
# v2.0.0 — XSPEC-193 §7.1 (AI-specific rules for AI-Generated Code)
|
|
5
|
+
# v2.1.0 — XSPEC-193 Phase 2 (ClearlyDefined API + AST PII + EmbeddingProvider + ASPEC-001)
|
|
3
6
|
|
|
4
7
|
id: license-compliance
|
|
5
|
-
title: License Compliance Standards
|
|
6
|
-
version: "1.0
|
|
8
|
+
title: License Compliance Standards for AI-Generated Code
|
|
9
|
+
version: "2.1.0"
|
|
7
10
|
status: Active
|
|
8
|
-
tags: [compliance, licensing, open-source, legal, supply-chain]
|
|
11
|
+
tags: [compliance, licensing, open-source, legal, supply-chain, ai-generated, eu-ai-act, sbom, pii, clearly-defined, ast-pii, embedding]
|
|
12
|
+
created: 2026-04-30
|
|
13
|
+
updated: 2026-05-16
|
|
14
|
+
|
|
15
|
+
agent_ref: ASPEC-001 # License Compliance Agent spec (XSPEC-205 format)
|
|
16
|
+
|
|
17
|
+
references:
|
|
18
|
+
- XSPEC-066 # v1.0.0 baseline - Wave 3 Compliance Pack
|
|
19
|
+
- XSPEC-193 # v2.0.0 + v2.1.0 AI-specific rules - VibeOps License Compliance Agent
|
|
20
|
+
- DEC-041 # EU AI Act compliance
|
|
21
|
+
- DEC-062 # Harness Engineering 2026 adoption
|
|
22
|
+
- DEC-063 # VibeOps legal & compliance strategy
|
|
23
|
+
- DEC-064 # Customer IP isolation (cache salt)
|
|
24
|
+
- XSPEC-189 # Telemetry Schema v2 (event types referenced below)
|
|
25
|
+
- ASPEC-001 # License Compliance Agent SPEC (XSPEC-205 §REQ-2 format)
|
|
26
|
+
|
|
9
27
|
summary: |
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
SBOM generation,
|
|
14
|
-
|
|
15
|
-
|
|
28
|
+
Comprehensive license compliance for AI-augmented development.
|
|
29
|
+
|
|
30
|
+
Tier 1 (REQ-001~006) — General OSS practices: license classification,
|
|
31
|
+
CI scanning, SBOM generation, attribution, violation remediation, and
|
|
32
|
+
technology adoption review. Applies to every project regardless of AI use.
|
|
33
|
+
|
|
34
|
+
Tier 2 (LC-001~009) — AI-specific rules: SPDX-first, independent evaluator,
|
|
35
|
+
evidence-based decisions, blocklist/allowlist/greylist enforcement, SBOM
|
|
36
|
+
required on every PR, PII pattern detection, copyright similarity check,
|
|
37
|
+
EU AI Act Article 50 transparency markers, and customer policy sovereignty.
|
|
38
|
+
|
|
39
|
+
Tier 2 is binding on AI Agents that produce code (VibeOps Generator Agent
|
|
40
|
+
and equivalents). Designed to prevent legal exposure from incompatible
|
|
41
|
+
license combinations, ensure supply-chain transparency, and satisfy
|
|
42
|
+
EU AI Act Article 50 obligations.
|
|
43
|
+
|
|
44
|
+
v2.1.0 enhancements (XSPEC-193 Phase 2, 2026-05-16):
|
|
45
|
+
- LC-001 now backed by ClearlyDefined API (confidence ≥ 0.95 when CD available)
|
|
46
|
+
- LC-007 PII detection upgraded with tree-sitter AST semantic context
|
|
47
|
+
- LC-006 copyright similarity upgraded with EmbeddingProvider strategy
|
|
48
|
+
(onnx-minilm / ollama-bge-m3 / jaccard fallback)
|
|
49
|
+
|
|
50
|
+
scope:
|
|
51
|
+
applies_to:
|
|
52
|
+
- AI-generated code (Generator Agent output)
|
|
53
|
+
- Dependency manifests (package.json / requirements.txt / go.mod / Cargo.toml / etc.)
|
|
54
|
+
- Open-source code snippet references and copy-paste
|
|
55
|
+
excludes:
|
|
56
|
+
- Internal-only tooling scripts with no external distribution (SBOM still recommended)
|
|
57
|
+
- Fully hand-written, non-AI-generated code (SBOM still recommended)
|
|
58
|
+
|
|
59
|
+
principles:
|
|
60
|
+
- id: P-1
|
|
61
|
+
name: SPDX First
|
|
62
|
+
description: |
|
|
63
|
+
All license identifiers MUST use SPDX standard IDs (https://spdx.org/licenses/).
|
|
64
|
+
Vague descriptions like "MIT-like" or "BSD-style" are prohibited. If no
|
|
65
|
+
SPDX match can be found, the Agent MUST escalate to a human rather than
|
|
66
|
+
guess.
|
|
67
|
+
|
|
68
|
+
- id: P-2
|
|
69
|
+
name: Independent Evaluator
|
|
70
|
+
description: |
|
|
71
|
+
The License Compliance Agent MUST use a model class different from the
|
|
72
|
+
code Generator Agent. This avoids Generator/Evaluator error correlation
|
|
73
|
+
and preserves review independence (DEC-062 H6).
|
|
74
|
+
|
|
75
|
+
- id: P-3
|
|
76
|
+
name: Evidence-Based Decision
|
|
77
|
+
description: |
|
|
78
|
+
Every block or review-required decision MUST carry traceable evidence:
|
|
79
|
+
SPDX ID lookup source, similarity score, comparison repo URL, etc.
|
|
80
|
+
Verdicts without evidence are prohibited.
|
|
81
|
+
|
|
82
|
+
- id: P-4
|
|
83
|
+
name: Transparency by Default
|
|
84
|
+
description: |
|
|
85
|
+
AI-generated output MUST carry a transparency marker per EU AI Act
|
|
86
|
+
Article 50. Marker removal requires explicit human action; an AI Agent
|
|
87
|
+
MAY NOT decide to remove markers autonomously.
|
|
88
|
+
|
|
89
|
+
- id: P-5
|
|
90
|
+
name: Customer Sovereignty
|
|
91
|
+
description: |
|
|
92
|
+
Customers MAY customize license policy within their accepted liability
|
|
93
|
+
scope, but MAY NOT bypass platform-floor limits set in the VibeOps
|
|
94
|
+
EULA §9. Overrides MUST be telemetered with justification.
|
|
95
|
+
|
|
96
|
+
# ─────────────────────────────────────────────────────────────
|
|
97
|
+
# Tier 1 — General OSS Compliance Practices (v1.0.0 baseline)
|
|
98
|
+
# Applies to every project regardless of AI use.
|
|
99
|
+
# ─────────────────────────────────────────────────────────────
|
|
16
100
|
|
|
17
101
|
requirements:
|
|
18
102
|
- id: REQ-001
|
|
@@ -104,3 +188,288 @@ requirements:
|
|
|
104
188
|
- "ADR-042 notes: 'Library X uses Apache 2.0 — approved tier, no legal review needed'"
|
|
105
189
|
- "ADR-043 notes: 'Library Y uses LGPL-3.0 — review-required, legal approved 2026-03-10'"
|
|
106
190
|
- "Technology radar entry includes license classification for each evaluated tool"
|
|
191
|
+
|
|
192
|
+
# ─────────────────────────────────────────────────────────────
|
|
193
|
+
# Tier 2 — AI-Specific Rules (v2.0.0, XSPEC-193 §7.1)
|
|
194
|
+
# Binding on AI Agents that produce code.
|
|
195
|
+
# ─────────────────────────────────────────────────────────────
|
|
196
|
+
|
|
197
|
+
rules:
|
|
198
|
+
- id: LC-001
|
|
199
|
+
name: SPDX ID Lookup Required
|
|
200
|
+
severity: blocking
|
|
201
|
+
description: |
|
|
202
|
+
Every dependency license MUST be resolved to a SPDX standard ID
|
|
203
|
+
before any list comparison.
|
|
204
|
+
|
|
205
|
+
v2.1.0: Primary source is ClearlyDefined API (confidence ≥ 0.95 for
|
|
206
|
+
well-known packages). Falls back to SPDX database (confidence ≤ 0.8)
|
|
207
|
+
or package metadata heuristics. Requests are token-bucket-rate-limited
|
|
208
|
+
(10 req/s, burst 20) and cached with 24h TTL + DEC-064 client_salt
|
|
209
|
+
isolation. offline=true bypasses external calls entirely.
|
|
210
|
+
checks:
|
|
211
|
+
- "license_lookup() result must have non-null spdx_id"
|
|
212
|
+
- "If confidence < 0.7, escalate_to_human"
|
|
213
|
+
- "Free-text license fields from package metadata MUST NOT be used directly"
|
|
214
|
+
- "ClearlyDefined API: GET /definitions/{type}/{provider}/{namespace}/{name}/{revision}"
|
|
215
|
+
- "On 5xx: exponential backoff × 3 (200ms/1s/3s); on 429: batch fallback immediately"
|
|
216
|
+
- "Cache key = sha256(client_salt + ':' + purl) — DEC-064 isolation guaranteed"
|
|
217
|
+
|
|
218
|
+
- id: LC-002
|
|
219
|
+
name: Blocklist Auto-Block
|
|
220
|
+
severity: blocking
|
|
221
|
+
description: |
|
|
222
|
+
SPDX IDs on the Blocklist MUST trigger block_pr automatically. No
|
|
223
|
+
exception channel inside the platform (customer override layer may
|
|
224
|
+
remove items, but the override is logged via telemetry).
|
|
225
|
+
blocklist:
|
|
226
|
+
# Strong-copyleft (viral)
|
|
227
|
+
- GPL-2.0
|
|
228
|
+
- GPL-2.0-only
|
|
229
|
+
- GPL-2.0-or-later
|
|
230
|
+
- GPL-3.0
|
|
231
|
+
- GPL-3.0-only
|
|
232
|
+
- GPL-3.0-or-later
|
|
233
|
+
- AGPL-1.0
|
|
234
|
+
- AGPL-3.0
|
|
235
|
+
- AGPL-3.0-only
|
|
236
|
+
- AGPL-3.0-or-later
|
|
237
|
+
# Source-Available (non-OSS, commercially restrictive)
|
|
238
|
+
- SSPL-1.0
|
|
239
|
+
- Commons-Clause # Not a formal SPDX ID; treated as non-OSS
|
|
240
|
+
- BUSL-1.1
|
|
241
|
+
- BUSL-1.0
|
|
242
|
+
- Confluent-Community-License
|
|
243
|
+
- Elastic-License-2.0
|
|
244
|
+
checks:
|
|
245
|
+
- "license_blocklist_check() returns decision='block' → call block_pr() immediately"
|
|
246
|
+
- "block_pr() reason field is mandatory in form: '{pkg}@{version} uses {spdx_id}'"
|
|
247
|
+
|
|
248
|
+
- id: LC-003
|
|
249
|
+
name: Allowlist Auto-Approve
|
|
250
|
+
severity: informational
|
|
251
|
+
description: |
|
|
252
|
+
SPDX IDs on the Allowlist MUST be auto-approved, recorded in SBOM
|
|
253
|
+
without triggering review.
|
|
254
|
+
allowlist:
|
|
255
|
+
- MIT
|
|
256
|
+
- MIT-0
|
|
257
|
+
- BSD-2-Clause
|
|
258
|
+
- BSD-3-Clause
|
|
259
|
+
- BSD-3-Clause-Clear
|
|
260
|
+
- Apache-2.0
|
|
261
|
+
- ISC
|
|
262
|
+
- 0BSD
|
|
263
|
+
- CC0-1.0
|
|
264
|
+
- Unlicense
|
|
265
|
+
- Zlib
|
|
266
|
+
- WTFPL
|
|
267
|
+
- CC-BY-4.0 # Documentation only
|
|
268
|
+
- CC-BY-SA-4.0 # Documentation only
|
|
269
|
+
- Python-2.0 # PSF-specific
|
|
270
|
+
|
|
271
|
+
- id: LC-004
|
|
272
|
+
name: Greylist Human Review
|
|
273
|
+
severity: review_required
|
|
274
|
+
description: |
|
|
275
|
+
SPDX IDs on the Greylist enter the review queue. A human judges
|
|
276
|
+
whether the static/dynamic-linking model triggers copyleft contagion.
|
|
277
|
+
greylist:
|
|
278
|
+
- LGPL-2.1
|
|
279
|
+
- LGPL-2.1-only
|
|
280
|
+
- LGPL-2.1-or-later
|
|
281
|
+
- LGPL-3.0
|
|
282
|
+
- LGPL-3.0-only
|
|
283
|
+
- LGPL-3.0-or-later
|
|
284
|
+
- MPL-2.0
|
|
285
|
+
- EPL-1.0
|
|
286
|
+
- EPL-2.0
|
|
287
|
+
- CDDL-1.0
|
|
288
|
+
- CDDL-1.1
|
|
289
|
+
- GPL-Classpath-exception-2.0 # OpenJDK
|
|
290
|
+
review_guidance:
|
|
291
|
+
- "Determine static-link vs dynamic-link"
|
|
292
|
+
- "Determine whether the package is on the production path or only a dev/test dependency"
|
|
293
|
+
- "LGPL dynamic-link is generally safe; static-link requires legal sign-off"
|
|
294
|
+
|
|
295
|
+
- id: LC-005
|
|
296
|
+
name: SBOM Mandatory Generation
|
|
297
|
+
severity: blocking
|
|
298
|
+
description: |
|
|
299
|
+
Every dependency-list change or PR merge MUST regenerate the SBOM in
|
|
300
|
+
CycloneDX 1.5 or SPDX 2.3 format. SHA-256 hash of the SBOM file MUST
|
|
301
|
+
be recorded.
|
|
302
|
+
checks:
|
|
303
|
+
- "SBOM file passes the corresponding schema validation (CycloneDX XML/JSON schema)"
|
|
304
|
+
- "Every component in the SBOM has an SPDX license expression"
|
|
305
|
+
- "SBOM path: `{project_root}/sbom.cdx.json` (or `.spdx.json`)"
|
|
306
|
+
|
|
307
|
+
- id: LC-006
|
|
308
|
+
name: Copyright Similarity Threshold
|
|
309
|
+
severity: blocking
|
|
310
|
+
description: |
|
|
311
|
+
AI-generated code with embedding similarity ≥ 0.85 to a known
|
|
312
|
+
open-source repo MUST be inspected. If the source repo is on the
|
|
313
|
+
blocklist (GPL/AGPL), the PR MUST be blocked.
|
|
314
|
+
|
|
315
|
+
v2.1.0: EmbeddingProvider strategy (XSPEC-193 Phase 2):
|
|
316
|
+
- provider='onnx-minilm': local ONNX inference (all-MiniLM-L6-v2)
|
|
317
|
+
- provider='ollama-bge-m3': Ollama local API (bge-m3, localhost:11434)
|
|
318
|
+
- provider='jaccard' (default): Jaccard token similarity (Phase 1)
|
|
319
|
+
Known snippet index is per-customer (DEC-064 client_salt isolated).
|
|
320
|
+
External search is opt-in (enableExternalSearch=false by default).
|
|
321
|
+
checks:
|
|
322
|
+
- "overall_similarity >= 0.85 AND source_license in blocklist → block_pr"
|
|
323
|
+
- "overall_similarity >= 0.70 AND source_license in greylist → review"
|
|
324
|
+
- "overall_similarity >= 0.85 AND source_license in allowlist → record info event, do not block"
|
|
325
|
+
- "ONNX/Ollama unavailable → graceful fallback to Jaccard (no exception)"
|
|
326
|
+
- "snippet index build: buildSnippetIndex(snippets, provider) per-customer"
|
|
327
|
+
evidence_required:
|
|
328
|
+
- "source_repo URL"
|
|
329
|
+
- "source_license SPDX ID"
|
|
330
|
+
- "similarity score (4 decimal places)"
|
|
331
|
+
- "matched_section (first 5 lines of the snippet)"
|
|
332
|
+
- "embedding_provider used (for audit trail)"
|
|
333
|
+
|
|
334
|
+
- id: LC-007
|
|
335
|
+
name: PII Pattern Detection
|
|
336
|
+
severity: review_required
|
|
337
|
+
description: |
|
|
338
|
+
When AI-generated code contains a personal-data handling pattern,
|
|
339
|
+
issue a warning with a remediation hint. severity="critical" patterns
|
|
340
|
+
MUST escalate to human review.
|
|
341
|
+
|
|
342
|
+
v2.1.0: AST-enhanced detection via tree-sitter (XSPEC-193 Phase 2):
|
|
343
|
+
- Language support: TypeScript, JavaScript, Python
|
|
344
|
+
- AST context classification:
|
|
345
|
+
hardcoded_value → severity upgraded to critical
|
|
346
|
+
comment → severity downgraded to info
|
|
347
|
+
schema_field → ast_context='schema_field'
|
|
348
|
+
- Pragma support: // pii:ignore on same line suppresses finding
|
|
349
|
+
- tree-sitter unavailable → graceful fallback to regex (no exception)
|
|
350
|
+
- LLM assist: stub (enableLLMAssist=false default, Phase 3 integration)
|
|
351
|
+
- PIIPattern.confidence and PIIPattern.ast_context are new optional fields
|
|
352
|
+
pii_types:
|
|
353
|
+
critical:
|
|
354
|
+
- ssn # Social security number
|
|
355
|
+
- credit_card # Credit-card number
|
|
356
|
+
- biometric # Biometric identifiers
|
|
357
|
+
- health_record # Health records (HIPAA / Taiwan PDPA §6 special category)
|
|
358
|
+
warning:
|
|
359
|
+
- email
|
|
360
|
+
- phone
|
|
361
|
+
- id_number # National ID
|
|
362
|
+
- date_of_birth
|
|
363
|
+
- address
|
|
364
|
+
detection_strategy:
|
|
365
|
+
- "regex: field-name patterns (email, phone_number, ssn, credit_card_number, ...)"
|
|
366
|
+
- "ast: tree-sitter semantic context (hardcoded_value / comment / schema_field)"
|
|
367
|
+
- "llm_assist: ambiguous contexts (confidence threshold 0.8, Phase 3)"
|
|
368
|
+
|
|
369
|
+
- id: LC-008
|
|
370
|
+
name: EU AI Act Transparency Marker
|
|
371
|
+
severity: blocking
|
|
372
|
+
description: |
|
|
373
|
+
Every AI-generated source file MUST carry a transparency marker at
|
|
374
|
+
output time, per EU AI Act Article 50 (Limited-Risk transparency
|
|
375
|
+
obligation).
|
|
376
|
+
marker_format:
|
|
377
|
+
source_code: |
|
|
378
|
+
// AI-generated: VibeOps v{version} on {date}
|
|
379
|
+
// AI Generation Disclosure: Per EU AI Act Article 50.
|
|
380
|
+
// Modifications by humans should remove this notice.
|
|
381
|
+
markdown: |
|
|
382
|
+
---
|
|
383
|
+
> AI Generation Disclosure: This content was AI-generated by VibeOps
|
|
384
|
+
> v{version} on {date}. Per EU AI Act Article 50.
|
|
385
|
+
json_yaml: |
|
|
386
|
+
_ai_generated: "VibeOps v{version} on {date} — EU AI Act Article 50"
|
|
387
|
+
checks:
|
|
388
|
+
- "Marker MUST be in the file header (source code) or metadata block (JSON/YAML)"
|
|
389
|
+
- "Marker removal requires the transparency_marker tool's explicit remove operation plus human confirmation"
|
|
390
|
+
- "When eu_ai_act_classifier() returns high_risk, additionally include a human_oversight statement"
|
|
391
|
+
|
|
392
|
+
- id: LC-009
|
|
393
|
+
name: Customer Policy Ceiling
|
|
394
|
+
severity: informational
|
|
395
|
+
description: |
|
|
396
|
+
Customers MAY adjust lists via ~/.vibeops/license-policy.yaml, but
|
|
397
|
+
adjustments MUST be telemetered (human_override_block event) and MUST
|
|
398
|
+
NOT modify the EULA §9 liability-allocation clause at the platform
|
|
399
|
+
layer.
|
|
400
|
+
checks:
|
|
401
|
+
- "If allowlist_add contains blocklist members, record a warning telemetry"
|
|
402
|
+
- "greylist_review: 'auto-allow' requires an extra telemetry tag customer_risk_accepted=true"
|
|
403
|
+
- "If the customer config schema validation fails, fall back to platform default policy"
|
|
404
|
+
|
|
405
|
+
# ─────────────────────────────────────────────────────────────
|
|
406
|
+
# Tool integration (XSPEC-193 §2, §3)
|
|
407
|
+
# ─────────────────────────────────────────────────────────────
|
|
408
|
+
|
|
409
|
+
tooling_integration:
|
|
410
|
+
description: |
|
|
411
|
+
Maps to the 10 tools defined in XSPEC-193 §2. Tool call order is fixed
|
|
412
|
+
to keep prompts cache-friendly under the DEC-064 cache-salt strategy.
|
|
413
|
+
tool_sequence:
|
|
414
|
+
1: dependency_reader # Read dependency manifest
|
|
415
|
+
2: license_lookup # SPDX lookup
|
|
416
|
+
3: license_blocklist_check # Tier check
|
|
417
|
+
4: sbom_generator # SBOM generation (LC-005)
|
|
418
|
+
5: pii_pattern_detector # PII detection (LC-007)
|
|
419
|
+
6: copyright_similarity_check # Copyright similarity (LC-006)
|
|
420
|
+
7: eu_ai_act_classifier # EU AI Act risk classification
|
|
421
|
+
8: transparency_marker # Transparency marker (LC-008)
|
|
422
|
+
9: block_pr # Sole flow-interrupting authority
|
|
423
|
+
10: suggest_alternative # Alternative package suggestion (XSPEC-193 §4.5)
|
|
424
|
+
11: escalate_to_human # Fallback when automation cannot decide
|
|
425
|
+
|
|
426
|
+
# ─────────────────────────────────────────────────────────────
|
|
427
|
+
# Telemetry (DEC-066 / XSPEC-189 v2 envelope)
|
|
428
|
+
# ─────────────────────────────────────────────────────────────
|
|
429
|
+
|
|
430
|
+
telemetry:
|
|
431
|
+
required_events:
|
|
432
|
+
- license_compliance_result # Final result of each review
|
|
433
|
+
- block_pr # Block event detail
|
|
434
|
+
- license_lookup_failure # SPDX lookup failure (drives alternative-table updates)
|
|
435
|
+
- copyright_similarity_high # High-similarity warning
|
|
436
|
+
- eu_ai_act_classification # Classification distribution
|
|
437
|
+
- human_override_block # Human override of a block (requires reason)
|
|
438
|
+
envelope_reference: XSPEC-189 # Telemetry Schema v2 envelope
|
|
439
|
+
event_type: quality
|
|
440
|
+
event_subtype_examples:
|
|
441
|
+
- license_compliance_result # LC rule outcomes
|
|
442
|
+
- gate_pass / gate_fail # When License Compliance acts as a gate
|
|
443
|
+
|
|
444
|
+
# ─────────────────────────────────────────────────────────────
|
|
445
|
+
# Adoption guidance
|
|
446
|
+
# ─────────────────────────────────────────────────────────────
|
|
447
|
+
|
|
448
|
+
adoption_guidance:
|
|
449
|
+
uds_install_path: ai/standards/license-compliance.ai.yaml
|
|
450
|
+
vibeops_config_path: src/agents/license-compliance/rules.yaml
|
|
451
|
+
customer_config_path: ~/.vibeops/license-policy.yaml
|
|
452
|
+
notes:
|
|
453
|
+
- "v2.1.0 adds ClearlyDefined API integration, AST PII analysis, and EmbeddingProvider strategy. Requires VibeOps ≥ v1.6.0 (commit c44a4bf)."
|
|
454
|
+
- "v2.0.0 Tier 2 rules are Active for AI-augmented projects. Legal sign-off on the blocklist remains pending; treat the blocklist as authoritative-pending-review."
|
|
455
|
+
- "LGPL greylist decisions should consult legal counsel."
|
|
456
|
+
- "Alternative-package table (XSPEC-193 §4.5) is updated quarterly, driven by license_lookup_failure telemetry."
|
|
457
|
+
- "When this standard is consumed by VibeOps, the License Compliance Agent enforces every LC rule listed above. Other adopters MAY choose to enforce LC rules via CI alone (Tier 1 REQ-002 path)."
|
|
458
|
+
|
|
459
|
+
# ─────────────────────────────────────────────────────────────
|
|
460
|
+
# Compatibility note
|
|
461
|
+
# ─────────────────────────────────────────────────────────────
|
|
462
|
+
|
|
463
|
+
compatibility:
|
|
464
|
+
v1_to_v2: |
|
|
465
|
+
v1.0.0 REQ-001~006 are unchanged and remain authoritative for general
|
|
466
|
+
OSS practice. v2.0.0 adds Tier 2 LC-001~009 as a strict superset for
|
|
467
|
+
AI-augmented projects. A project that adopted v1.0.0 remains compliant;
|
|
468
|
+
AI-augmented projects MUST additionally enforce Tier 2.
|
|
469
|
+
v2_to_v2_1: |
|
|
470
|
+
v2.1.0 is a backward-compatible superset of v2.0.0. New features
|
|
471
|
+
(ClearlyDefined API, AST PII, EmbeddingProvider) are opt-in via
|
|
472
|
+
ComplianceAgentConfig. All existing LC-001~009 rules are unchanged.
|
|
473
|
+
PIIPattern gains optional fields (confidence, ast_context); existing
|
|
474
|
+
code that reads PIIPattern is unaffected.
|
|
475
|
+
Minimum runtime: Node.js 22 + VibeOps v1.6.0.
|
|
@@ -158,3 +158,22 @@ standard:
|
|
|
158
158
|
evidence: >
|
|
159
159
|
BUG-A08 post-mortem (2026-04-20): 22 tests existed in UDS but were never
|
|
160
160
|
executed by any CI gate, passing silently and masking real failures.
|
|
161
|
+
|
|
162
|
+
- id: gate-wiring-required
|
|
163
|
+
trigger: adding any quality detection script to the repository
|
|
164
|
+
instruction: |
|
|
165
|
+
Quality detection scripts (anti-fake check, stub check, coverage ratchet,
|
|
166
|
+
tautology scanner) MUST appear in at least one CI workflow job AND at least
|
|
167
|
+
one local hook (pre-commit or pre-push). A script that exists in scripts/
|
|
168
|
+
but is never called by CI is equivalent to not existing and constitutes a
|
|
169
|
+
governance gap. Apply the same execution-continuity principle to detection
|
|
170
|
+
scripts as to test cases: existence ≠ execution.
|
|
171
|
+
Checklist when adding a detection script:
|
|
172
|
+
[ ] Script is called in .github/workflows/*.yml (at least one job)
|
|
173
|
+
[ ] Script is called in .husky/pre-commit or .husky/pre-push
|
|
174
|
+
[ ] CI step name references the XSPEC or standard that mandates it
|
|
175
|
+
priority: required
|
|
176
|
+
evidence: >
|
|
177
|
+
XSPEC-220 post-mortem (2026-05-19): check-anti-fake-tests.sh existed in
|
|
178
|
+
vibeops/scripts/ for months but was not called by pre-commit, allowing
|
|
179
|
+
tautology assertions to be committed undetected.
|
|
@@ -0,0 +1,118 @@
|
|
|
1
|
+
# License Compliance Standards
|
|
2
|
+
|
|
3
|
+
> **Version**: 2.1.0 | **Status**: Active | **Updated**: 2026-05-16
|
|
4
|
+
> **AI-optimized version**: `ai/standards/license-compliance.ai.yaml`
|
|
5
|
+
> **Agent Spec**: ASPEC-001 (cross-project/aspec/ASPEC-001-license-compliance-agent.md)
|
|
6
|
+
|
|
7
|
+
## Overview
|
|
8
|
+
|
|
9
|
+
Comprehensive license compliance for AI-augmented development, covering both general OSS practice (Tier 1) and AI-specific rules for AI-generated code (Tier 2).
|
|
10
|
+
|
|
11
|
+
## Tier 1 — General OSS Compliance Practices
|
|
12
|
+
|
|
13
|
+
Applies to every project regardless of AI use.
|
|
14
|
+
|
|
15
|
+
| ID | Rule | Level |
|
|
16
|
+
|----|------|-------|
|
|
17
|
+
| REQ-001 | License classification and allowlist | MUST |
|
|
18
|
+
| REQ-002 | Automated license scanning in CI | MUST |
|
|
19
|
+
| REQ-003 | SBOM generation (CycloneDX 1.5 or SPDX 2.3) | MUST |
|
|
20
|
+
| REQ-004 | License attribution and NOTICES file | MUST |
|
|
21
|
+
| REQ-005 | License violation remediation (5 business days) | MUST |
|
|
22
|
+
| REQ-006 | License review for new technology adoption | SHOULD |
|
|
23
|
+
|
|
24
|
+
### License Tiers
|
|
25
|
+
|
|
26
|
+
| Tier | Licenses | Action |
|
|
27
|
+
|------|----------|--------|
|
|
28
|
+
| APPROVED | MIT, Apache 2.0, BSD-2/3-Clause, ISC, CC0 | Auto-approve |
|
|
29
|
+
| REVIEW-REQUIRED | LGPL-2.1/3.0, MPL-2.0, CDDL | Legal review before adoption |
|
|
30
|
+
| PROHIBITED | GPL-2.0/3.0, AGPL-3.0, SSPL-1.0, BUSL-1.1 | Block PR immediately |
|
|
31
|
+
|
|
32
|
+
## Tier 2 — AI-Specific Rules
|
|
33
|
+
|
|
34
|
+
Binding on AI Agents that produce code (VibeOps Generator Agent and equivalents).
|
|
35
|
+
|
|
36
|
+
| ID | Rule | Severity |
|
|
37
|
+
|----|------|----------|
|
|
38
|
+
| LC-001 | SPDX ID lookup required | Blocking |
|
|
39
|
+
| LC-002 | Blocklist auto-block | Blocking |
|
|
40
|
+
| LC-003 | Allowlist auto-approve | Informational |
|
|
41
|
+
| LC-004 | Greylist human review | Review required |
|
|
42
|
+
| LC-005 | SBOM mandatory generation | Blocking |
|
|
43
|
+
| LC-006 | Copyright similarity threshold (≥0.85 block) | Blocking |
|
|
44
|
+
| LC-007 | PII pattern detection | Review required |
|
|
45
|
+
| LC-008 | EU AI Act transparency marker | Blocking |
|
|
46
|
+
| LC-009 | Customer policy ceiling | Informational |
|
|
47
|
+
|
|
48
|
+
## v2.1.0 Enhancements (XSPEC-193 Phase 2)
|
|
49
|
+
|
|
50
|
+
### ClearlyDefined API (LC-001)
|
|
51
|
+
|
|
52
|
+
- Primary license lookup source: `https://api.clearlydefined.io/definitions/{type}/{provider}/{namespace}/{name}/{revision}`
|
|
53
|
+
- Confidence ≥ 0.95 for well-known packages (score.total ≥ 80)
|
|
54
|
+
- 24h TTL LRU cache (cap=500) + negative cache for 404
|
|
55
|
+
- Token bucket: 10 req/s, burst 20
|
|
56
|
+
- Retry strategy: 5xx → exponential backoff × 3 (200ms/1s/3s); 429 → batch fallback
|
|
57
|
+
- DEC-064 cache key isolation: `sha256(client_salt + ':' + purl)`
|
|
58
|
+
|
|
59
|
+
### AST PII Analysis (LC-007)
|
|
60
|
+
|
|
61
|
+
- Tree-sitter support: TypeScript, JavaScript, Python
|
|
62
|
+
- Context classification:
|
|
63
|
+
- `hardcoded_value` → severity upgraded to `critical`
|
|
64
|
+
- `comment` → severity downgraded to `info`
|
|
65
|
+
- `schema_field` → annotated, no severity change
|
|
66
|
+
- `// pii:ignore` pragma: suppresses findings on same line
|
|
67
|
+
- Optional fields: `PIIPattern.confidence`, `PIIPattern.ast_context`
|
|
68
|
+
- Graceful fallback to regex when tree-sitter unavailable
|
|
69
|
+
|
|
70
|
+
### EmbeddingProvider Strategy (LC-006)
|
|
71
|
+
|
|
72
|
+
- `provider='onnx-minilm'`: ONNX local inference (all-MiniLM-L6-v2)
|
|
73
|
+
- `provider='ollama-bge-m3'`: Ollama local API (localhost:11434)
|
|
74
|
+
- `provider='jaccard'`: Jaccard token similarity (Phase 1 baseline, default)
|
|
75
|
+
- In-memory snippet index (`buildSnippetIndex()`) per-customer (DEC-064 salt)
|
|
76
|
+
- External search: opt-in via `enableExternalSearch=true` (default=false)
|
|
77
|
+
|
|
78
|
+
## Principles
|
|
79
|
+
|
|
80
|
+
| ID | Principle |
|
|
81
|
+
|----|-----------|
|
|
82
|
+
| P-1 | SPDX First — all license IDs must be SPDX standard |
|
|
83
|
+
| P-2 | Independent Evaluator — different model class from Generator |
|
|
84
|
+
| P-3 | Evidence-Based Decision — every block carries traceable evidence |
|
|
85
|
+
| P-4 | Transparency by Default — EU AI Act Article 50 markers required |
|
|
86
|
+
| P-5 | Customer Sovereignty — policy customizable within EULA §9 limits |
|
|
87
|
+
|
|
88
|
+
## Tool Sequence (XSPEC-193 §2)
|
|
89
|
+
|
|
90
|
+
```
|
|
91
|
+
1. dependency_reader
|
|
92
|
+
2. license_lookup ← ClearlyDefined API (v2.1.0)
|
|
93
|
+
3. license_blocklist_check
|
|
94
|
+
4. sbom_generator
|
|
95
|
+
5. pii_pattern_detector ← AST-enhanced (v2.1.0)
|
|
96
|
+
6. copyright_similarity_check ← EmbeddingProvider (v2.1.0)
|
|
97
|
+
7. eu_ai_act_classifier
|
|
98
|
+
8. transparency_marker
|
|
99
|
+
9. block_pr
|
|
100
|
+
10. suggest_alternative
|
|
101
|
+
11. escalate_to_human
|
|
102
|
+
```
|
|
103
|
+
|
|
104
|
+
## Related Specs
|
|
105
|
+
|
|
106
|
+
- XSPEC-193 — License Compliance Agent complete spec
|
|
107
|
+
- XSPEC-066 — Wave 3 Compliance Pack (v1.0.0 baseline)
|
|
108
|
+
- DEC-063 — VibeOps legal & compliance strategy
|
|
109
|
+
- DEC-064 — Customer IP isolation (cache salt)
|
|
110
|
+
- ASPEC-001 — License Compliance Agent SPEC (XSPEC-205 §REQ-2 format)
|
|
111
|
+
|
|
112
|
+
## Changelog
|
|
113
|
+
|
|
114
|
+
| Version | Date | Changes |
|
|
115
|
+
|---------|------|---------|
|
|
116
|
+
| v1.0.0 | 2026-04-30 | Initial — REQ-001~006 general OSS practices |
|
|
117
|
+
| v2.0.0 | 2026-05-14 | Added Tier 2 LC-001~009 AI-specific rules |
|
|
118
|
+
| v2.1.0 | 2026-05-16 | ClearlyDefined API + AST PII + EmbeddingProvider + ASPEC-001 ref |
|
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
---
|
|
2
2
|
source: ../../CHANGELOG.md
|
|
3
|
-
source_version: 5.
|
|
4
|
-
translation_version: 5.
|
|
5
|
-
last_synced: 2026-05-
|
|
3
|
+
source_version: 5.12.1
|
|
4
|
+
translation_version: 5.12.1
|
|
5
|
+
last_synced: 2026-05-19
|
|
6
6
|
status: current
|
|
7
7
|
---
|
|
8
8
|
|
|
@@ -17,6 +17,35 @@ status: current
|
|
|
17
17
|
|
|
18
18
|
## [Unreleased]
|
|
19
19
|
|
|
20
|
+
## [5.12.0] - 2026-05-16
|
|
21
|
+
|
|
22
|
+
### 新增
|
|
23
|
+
- **`docs/user/` 用户文档体系**（XSPEC-211）：新增双轨文档结构，仿照 VibeOps 惯例，包含 8 份文档：
|
|
24
|
+
- `docs/user/GETTING-STARTED.md` — 5 分钟端到端教程（install → `uds init` → `/sdd` → `/commit`）
|
|
25
|
+
- `docs/user/SKILLS-INDEX.md` — 自动生成的 54 个 skill 索引，按 Tier（DEC-061）与 Category 分类，含「触发时机速查」表
|
|
26
|
+
- `docs/user/COMMANDS-INDEX.md` — 自动生成的 48 个 slash command 字母序列表，含 skill 对应
|
|
27
|
+
- `docs/user/FAQ.md` — 14 题常见问题（安装、skill、SDD、升级、架构）
|
|
28
|
+
- `docs/user/GLOSSARY.md` — UDS、SDD、ATDD、BDD、TDD、XSPEC、Dual-Layer、Skill Tier、Standard、Activity、Bundle/Source、ADR、AC 等术语定义
|
|
29
|
+
- `docs/user/TROUBLESHOOTING.md` — 问题→解法指南，整合 `SKILL-FALLBACK-GUIDE.md` 内容
|
|
30
|
+
- `docs/user/README.md` — 三类受众入口（新手 / 日常用户 / 维护者）+ 文档地图
|
|
31
|
+
- `docs/user/CHEATSHEET.md` — 从 `docs/` 移入（内容不变）
|
|
32
|
+
- **`scripts/generate-skill-index.ts`** — 从 `uds-manifest.json` + `skills/*/SKILL.md` frontmatter 生成 SKILLS-INDEX.md 与 COMMANDS-INDEX.md。执行：`npm run docs:generate-index`
|
|
33
|
+
- **`scripts/check-skill-index.ts`** — pre-commit 守门；重生成后 diff，不同步则 exit 非零。执行：`npm run docs:check-index`
|
|
34
|
+
- **`scripts/setup-hooks.sh`** — 安装 `.git/hooks/pre-commit`，每次 commit 自动调用 `docs:check-index`
|
|
35
|
+
- **`.github/workflows/docs-check.yml`** — CI job：PR 修改 manifest/SKILL.md/registry 时验证 INDEX 文档已同步
|
|
36
|
+
- **`docs/reference/FEATURE-REFERENCE.md`** — FEATURE-REFERENCE.md 从 `docs/` 迁移至 `docs/reference/`（自动生成，内容不变）
|
|
37
|
+
- **`docs/archive/USER-MANUAL-2026-03-24.md`** — 已废弃 User Manual 的归档备份
|
|
38
|
+
|
|
39
|
+
### 变更
|
|
40
|
+
- **`package.json`**：新增 `docs:generate-index` 与 `docs:check-index` npm scripts
|
|
41
|
+
- **`scripts/generate-usage-docs.mjs`**：更新英文输出路径（FEATURE-REFERENCE → `docs/reference/`，CHEATSHEET → `docs/user/`）
|
|
42
|
+
- **`skills/README.md`**：新增 banner 指向 `docs/user/SKILLS-INDEX.md` 与 `COMMANDS-INDEX.md`
|
|
43
|
+
- **`README.md`**：Quick Start 段落新增「📚 Documentation」表格，列出 7 份 `docs/user/` 文档直链
|
|
44
|
+
- **`docs/USER-MANUAL.md`**：新增 deprecation banner 指向 `docs/user/README.md`；归档备份保留于 `docs/archive/`
|
|
45
|
+
|
|
46
|
+
### 移除
|
|
47
|
+
- **`docs/SKILL-FALLBACK-GUIDE.md`**：内容已整合至 `docs/user/TROUBLESHOOTING.md`。非 Claude Code 工具的 fallback 策略与 Skill→Core Standard 对应表保留于「Using UDS Without Claude Code」段落
|
|
48
|
+
|
|
20
49
|
## [5.11.0] - 2026-05-14
|
|
21
50
|
|
|
22
51
|
### 新增 / Added
|
|
@@ -14,7 +14,7 @@ status: current
|
|
|
14
14
|
|
|
15
15
|
> **语言**: [English](../../README.md) | [繁體中文](../zh-TW/README.md) | 简体中文
|
|
16
16
|
|
|
17
|
-
**版本**: 5.
|
|
17
|
+
**版本**: 5.12.1 | **发布日期**: 2026-05-14 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
|
|
18
18
|
|
|
19
19
|
语言无关、框架无关的软件项目文档标准。通过 AI 原生工作流，确保不同技术栈之间的一致性、质量和可维护性。
|
|
20
20
|
|
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
---
|
|
2
2
|
source: ../../CHANGELOG.md
|
|
3
|
-
source_version: 5.
|
|
4
|
-
translation_version: 5.
|
|
5
|
-
last_synced: 2026-05-
|
|
3
|
+
source_version: 5.12.1
|
|
4
|
+
translation_version: 5.12.1
|
|
5
|
+
last_synced: 2026-05-19
|
|
6
6
|
status: current
|
|
7
7
|
---
|
|
8
8
|
|
|
@@ -17,6 +17,42 @@ status: current
|
|
|
17
17
|
|
|
18
18
|
## [Unreleased]
|
|
19
19
|
|
|
20
|
+
## [5.12.1] - 2026-05-19
|
|
21
|
+
|
|
22
|
+
### 變更
|
|
23
|
+
- **`full-coverage-testing.ai.yaml`**（`no-tautology-assertions` 規則，XSPEC-220）：AI agent 生成未實作測試骨架時，**必須**使用 `it.todo("AC-XXX: ...")`，禁止使用含 `expect(true).toBe(true)` 的 `it()` callback——無論由人類或 AI agent 生成，均視為 `[ANTI-FAKE-001]` 違規。
|
|
24
|
+
- **`test-governance.ai.yaml`**（`gate-wiring-required` 規則，XSPEC-220）：品質偵測腳本（anti-fake、stub-check、coverage ratchet）**必須**同時出現在至少一個 CI workflow job 與至少一個 local hook。腳本存在於 `scripts/` 但從未被 CI 呼叫，等同不存在，視為治理缺口。
|
|
25
|
+
- **`acceptance-criteria-traceability.ai.yaml`**（`not_implemented` 狀態，XSPEC-220）：明確定義 `it.todo()` 佔位符對應 `not_implemented 🚫` 狀態（不計入覆蓋率分母），補充決策樹區分 `not_implemented`（有意識標記）與 `uncovered`（遺漏）。
|
|
26
|
+
|
|
27
|
+
## [5.12.0] - 2026-05-16
|
|
28
|
+
|
|
29
|
+
### 新增
|
|
30
|
+
- **`docs/user/` 使用者文件體系**（XSPEC-211）：新增雙軌文件結構，仿照 VibeOps 慣例，包含 8 份文件：
|
|
31
|
+
- `docs/user/GETTING-STARTED.md` — 5 分鐘端到端教學（install → `uds init` → `/sdd` → `/commit`）
|
|
32
|
+
- `docs/user/SKILLS-INDEX.md` — 自動生成的 54 個 skill 索引，依 Tier（DEC-061）與 Category 分類，含「觸發時機速查」表
|
|
33
|
+
- `docs/user/COMMANDS-INDEX.md` — 自動生成的 48 個 slash command 字母序清單，含 skill 對應
|
|
34
|
+
- `docs/user/FAQ.md` — 14 題常見問題（安裝、skill、SDD、升級、架構）
|
|
35
|
+
- `docs/user/GLOSSARY.md` — UDS、SDD、ATDD、BDD、TDD、XSPEC、Dual-Layer、Skill Tier、Standard、Activity、Bundle/Source、ADR、AC 等術語定義
|
|
36
|
+
- `docs/user/TROUBLESHOOTING.md` — 問題→解法指南，整合 `SKILL-FALLBACK-GUIDE.md` 內容
|
|
37
|
+
- `docs/user/README.md` — 三類受眾入口（新手 / 日常使用者 / 維護者）+ 文件地圖
|
|
38
|
+
- `docs/user/CHEATSHEET.md` — 從 `docs/` 移入（內容不變）
|
|
39
|
+
- **`scripts/generate-skill-index.ts`** — 從 `uds-manifest.json` + `skills/*/SKILL.md` frontmatter 生成 SKILLS-INDEX.md 與 COMMANDS-INDEX.md。執行：`npm run docs:generate-index`
|
|
40
|
+
- **`scripts/check-skill-index.ts`** — pre-commit 守門；重生成後 diff，不同步則 exit 非零。執行：`npm run docs:check-index`
|
|
41
|
+
- **`scripts/setup-hooks.sh`** — 安裝 `.git/hooks/pre-commit`，每次 commit 自動呼叫 `docs:check-index`
|
|
42
|
+
- **`.github/workflows/docs-check.yml`** — CI job：PR 修改 manifest/SKILL.md/registry 時驗證 INDEX 文件已同步
|
|
43
|
+
- **`docs/reference/FEATURE-REFERENCE.md`** — FEATURE-REFERENCE.md 從 `docs/` 遷移至 `docs/reference/`（自動生成，內容不變）
|
|
44
|
+
- **`docs/archive/USER-MANUAL-2026-03-24.md`** — 已廢棄 User Manual 的歸檔備份
|
|
45
|
+
|
|
46
|
+
### 變更
|
|
47
|
+
- **`package.json`**：新增 `docs:generate-index` 與 `docs:check-index` npm scripts
|
|
48
|
+
- **`scripts/generate-usage-docs.mjs`**：更新英文輸出路徑（FEATURE-REFERENCE → `docs/reference/`，CHEATSHEET → `docs/user/`）
|
|
49
|
+
- **`skills/README.md`**：新增 banner 指向 `docs/user/SKILLS-INDEX.md` 與 `COMMANDS-INDEX.md`
|
|
50
|
+
- **`README.md`**：Quick Start 段落新增「📚 Documentation」表格，列出 7 份 `docs/user/` 文件直連
|
|
51
|
+
- **`docs/USER-MANUAL.md`**：新增 deprecation banner 指向 `docs/user/README.md`；歸檔備份保留於 `docs/archive/`
|
|
52
|
+
|
|
53
|
+
### 移除
|
|
54
|
+
- **`docs/SKILL-FALLBACK-GUIDE.md`**：內容已整合至 `docs/user/TROUBLESHOOTING.md`。非 Claude Code 工具的 fallback 策略與 Skill→Core Standard 對應表保留於「Using UDS Without Claude Code」段落
|
|
55
|
+
|
|
20
56
|
## [5.11.0] - 2026-05-14
|
|
21
57
|
|
|
22
58
|
### 新增 / Added
|
|
@@ -14,7 +14,7 @@ status: current
|
|
|
14
14
|
|
|
15
15
|
> **語言**: [English](../../README.md) | 繁體中文 | [简体中文](../zh-CN/README.md)
|
|
16
16
|
|
|
17
|
-
**版本**: 5.
|
|
17
|
+
**版本**: 5.12.1 | **發布日期**: 2026-05-14 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
|
|
18
18
|
|
|
19
19
|
語言無關、框架無關的軟體專案文件標準。透過 AI 原生工作流，確保不同技術堆疊之間的一致性、品質和可維護性。
|
|
20
20
|
|
package/bundled/skills/README.md
CHANGED
|
@@ -4,6 +4,9 @@ This directory contains the reference implementations of Universal Development S
|
|
|
4
4
|
|
|
5
5
|
> Derived from [universal-dev-standards](https://github.com/AsiaOstrich/universal-dev-standards) core standards.
|
|
6
6
|
|
|
7
|
+
> **For the full indexed skill list** (by Tier, Category, and use case), see **[docs/user/SKILLS-INDEX.md](../docs/user/SKILLS-INDEX.md)** (auto-generated).
|
|
8
|
+
> For slash command reference, see **[docs/user/COMMANDS-INDEX.md](../docs/user/COMMANDS-INDEX.md)**.
|
|
9
|
+
|
|
7
10
|
## Directory Structure
|
|
8
11
|
|
|
9
12
|
```
|
package/package.json
CHANGED
package/standards-registry.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
3
|
-
"version": "5.
|
|
3
|
+
"version": "5.12.1",
|
|
4
4
|
"lastUpdated": "2026-05-13",
|
|
5
5
|
"description": "Standards registry for universal-dev-standards with integrated skills and AI-optimized formats",
|
|
6
6
|
"formats": {
|
|
@@ -58,14 +58,14 @@
|
|
|
58
58
|
"standards": {
|
|
59
59
|
"name": "universal-dev-standards",
|
|
60
60
|
"url": "https://github.com/AsiaOstrich/universal-dev-standards",
|
|
61
|
-
"version": "5.
|
|
61
|
+
"version": "5.12.1"
|
|
62
62
|
},
|
|
63
63
|
"skills": {
|
|
64
64
|
"name": "universal-dev-standards",
|
|
65
65
|
"url": "https://github.com/AsiaOstrich/universal-dev-standards",
|
|
66
66
|
"localPath": "skills",
|
|
67
67
|
"rawUrl": "https://raw.githubusercontent.com/AsiaOstrich/universal-dev-standards/main/skills",
|
|
68
|
-
"version": "5.
|
|
68
|
+
"version": "5.12.1",
|
|
69
69
|
"note": "Skills are now included in the main repository under skills/"
|
|
70
70
|
}
|
|
71
71
|
},
|
|
@@ -2326,12 +2326,13 @@
|
|
|
2326
2326
|
"id": "license-compliance",
|
|
2327
2327
|
"name": "License Compliance Standards",
|
|
2328
2328
|
"nameZh": "授權合規標準",
|
|
2329
|
+
"version": "5.12.1",
|
|
2329
2330
|
"source": {
|
|
2330
2331
|
"human": "core/license-compliance.md",
|
|
2331
2332
|
"ai": "ai/standards/license-compliance.ai.yaml"
|
|
2332
2333
|
},
|
|
2333
2334
|
"category": "core",
|
|
2334
|
-
"description": "License tier classification, automated scanning in CI, SBOM generation, attribution notices, and
|
|
2335
|
+
"description": "License tier classification, automated scanning in CI, SBOM generation, attribution notices, violation remediation, ClearlyDefined API, AST PII analysis, and EmbeddingProvider copyright similarity"
|
|
2335
2336
|
},
|
|
2336
2337
|
{
|
|
2337
2338
|
"id": "pii-classification",
|