universal-dev-standards 5.16.0 → 6.0.0

package/bundled/ai/standards/developer-memory.ai.yaml

@@ -13,8 +13,8 @@ standard:
     - "Respect noise control levels and cooldown periods"
 
   meta:
-    version: "1.0.0"
-    updated: "2026-02-07"
+    version: "1.1.0"
+    updated: "2026-06-18"
     source: core/developer-memory.md
     description: Structured system for capturing, retrieving, and surfacing developer experience insights across conversations and projects
 
@@ -115,7 +115,8 @@ standard:
       bonus_rules:
         - "3 consecutive valid: bonus +0.05"
         - "3 consecutive invalid: flag for review"
-        - "confidence < 0.2: flag for retirement"
+        - "confidence < 0.2: flag for retirement (repeatedly invalidated = noise)"
+        - "not surfaced 180+ days AND confidence < 0.5: flag for retirement (dormant + low confidence; 180d matches staleness model; UDS default, configurable)"
         - "confidence > 0.9 after 10+ uses: mark proven"
 
     review:

package/bundled/ai/standards/flow-based-testing.ai.yaml

@@ -3,8 +3,8 @@
 
 id: flow-based-testing
 meta:
-  version: "1.0.0"
-  updated: "2026-05-04"
+  version: "1.0.1"
+  updated: "2026-06-18"
   source: core/flow-based-testing.md
   description: Flow decomposition methodology for testing multi-step processes with branch coverage
 

package/bundled/ai/standards/forward-derivation-standards.ai.yaml

@@ -3,8 +3,8 @@
 
 id: forward-derivation
 meta:
-  version: "1.1.0"
-  updated: "2026-04-01"
+  version: "1.3.0"
+  updated: "2026-06-18"
   source: core/forward-derivation-standards.md
   description: Standards for deriving BDD, TDD, IT, E2E, ATDD, and Contract tests from approved SDD specifications
 
@@ -134,6 +134,21 @@ anti_hallucination:
     - Inventing test cases beyond AC scope
     - Fabricating edge cases not specified
 
+# Failure handling (failure -> rollback -> retry/escalate -> re-verify)
+failure_handling:
+  description: What happens when a derivation gate fails; recovery always ends by re-verifying the failed gate
+  matrix:
+    - failure: AC parse error (unsupported format)
+      action: Abort that AC, report file:line + expected GWT/bullet format, emit no skeleton, re-queue after SPEC fix
+    - failure: AC count mismatch (tests != ACs)
+      action: "[anti-hallucination] hard rollback + regenerate strict 1:1; never add/delete tests to match the count"
+    - failure: Skeleton does not parse/compile
+      action: Roll back the file and regenerate with the correct template; on a 2nd failure mark the AC [BLOCKED] and escalate
+    - failure: Human review rejection
+      action: Record the reason and regenerate only the rejected items with that feedback; never auto-approve
+    - failure: Missing @SPEC/@AC attribution
+      action: Block the transition into TDD RED and re-emit with attribution
+
 # Commands
 commands:
   - command: "/derive-bdd"
@@ -167,6 +182,15 @@ commands:
 
 # Rules for AI
 rules:
+  - id: fd-fail-gate-halts
+    instruction: A gate failure must halt progression; never enter TDD RED with an unresolved failure
+    priority: required
+  - id: fd-fail-count-hard-rollback
+    instruction: A test/AC count mismatch is a hard rollback, not a reconciliation; never add or delete tests to match the count
+    priority: required
+  - id: fd-fail-bounded-retry-escalate
+    instruction: Bound automated retries (max 2 for transient/template errors); on exhaustion mark the AC [BLOCKED] and escalate to a human
+    priority: required
   - id: approved-spec-only
     instruction: Only derive from approved specifications
     priority: required

package/bundled/ai/standards/full-coverage-testing.ai.yaml

@@ -8,8 +8,8 @@ standard:
   description: Behavior-completeness full coverage paradigm replacing pyramid thresholds. Enforces anti-fake-test rules, STUB marker protocol, ratchet CI, and @ac traceability.
 
   meta:
-    version: "1.0.0"
-    updated: "2026-05-06"
+    version: "1.1.0"
+    updated: "2026-06-17"
     source: core/full-coverage-testing.md
     replaces: "testing pyramid thresholds (UT≥80%/IT≥70%/E2E happy-path-only)"
     xspec: "XSPEC-178"
@@ -191,6 +191,38 @@ standard:
       - "Anti-fake rules: no tautology, no business-logic mocks"
       - "STUB protocol: deployment gates on all environments"
 
+  # XSPEC-288: Migration Error-Path Completeness (axis 9 of XSPEC-284 completeness matrix)
+  # The three-path model requires an error path PER FUNCTION; this adds the migration
+  # guarantee that legacy error/degradation/fallback branches are SYSTEMATICALLY carried
+  # over, not merely sampled. Systematic-enumeration + gap-analysis layer above the
+  # XSPEC-201 error-path snapshot.
+  migration_error_path_completeness:
+    axis: "9 (error paths) of XSPEC-284 migration completeness matrix"
+    why_gap: "Per-function error path + XSPEC-201 snapshot verify only enumerated error cases. A rewrite drops scattered error branches in bulk; a passing sample does not prove no branch was missed."
+    derive: # R1 mechanized legacy exception/error-code list
+      sources:
+        catch_blocks: "grep catch/except/rescue -> every caught exception type + handler"
+        exception_hierarchy: "custom exception/error class taxonomy"
+        error_codes: "HTTP status, app error codes, error enums"
+        error_shapes: "error serializers/DTOs -> on-the-wire error contract"
+      note: "Captured list is the error-path to-verify checklist, sourced from artifacts not recall."
+    gap_analysis: # R2 systematic missing-branch oracle
+      rule: "for EACH legacy error branch verify a corresponding new-system handler; no mapping -> not_implemented (XSPEC-199) -> BLOCK"
+      output: "missing-error-branch gap report over the full derived list, not a passing sample"
+    degradation_parity: # R3
+      checklist: [external_failure_fallback, retry_policy, partial_result_handling, circuit_breaker_timeout]
+      goal: "not consistent on happy path but wildly different on failure"
+    error_response_differential: # R4
+      extends: "behavior-snapshot parity + XSPEC-284 R5 replay, applied to the ERROR response"
+      compare: [error_code, message_structure, http_status]
+    importance_ranking: "rank by production-actual trigger frequency (#134 production is the oracle); fired-in-prod branches mapped first; a high-frequency prod error branch with no mapping is a hard block"
+    gate_timing: [pre-UAT, "cutover before/after"]
+    completeness_declaration:
+      derive: "Step1 mechanized exception/error-code list"
+      oracle: "Step2 systematic gap analysis + Step4 error-response differential"
+      gate_timing: "pre-UAT + cutover before/after"
+      reuse: "XSPEC-201 error-path snapshot + three-path model; adds only systematic missing-branch analysis + error-response differential"
+
 physical_spec:
   type: custom_script
   validator:

package/bundled/ai/standards/git-worktree.ai.yaml

@@ -8,8 +8,8 @@ standard:
   description: Git Worktree 隔離開發標準
 
   meta:
-    version: "1.0.0"
-    updated: "2026-03-20"
+    version: "1.1.0"
+    updated: "2026-06-18"
     source: core/git-worktree.md
     description: Git Worktree 隔離開發與生命週期管理標準
     inspired_by: superpowers/using-git-worktrees
@@ -54,7 +54,7 @@ standard:
       priority: critical
     - id: GW-002
       trigger: "基準測試失敗"
-      action: "中止任務，報告環境問題"
+      action: "先重試至多 2 次（指數退避）以排除暫時性失敗；若持續失敗則中止任務並報告環境問題"
       priority: high
     - id: GW-003
       trigger: "異常退出"

package/bundled/ai/standards/logging.ai.yaml

@@ -3,10 +3,26 @@
 
 id: logging
 meta:
-  version: "1.3.0"
-  updated: "2026-05-26"
+  version: "1.4.0"
+  updated: "2026-06-17"
   source: core/logging-standards.md
-  description: Logging levels, structured logging, file rotation policy, and best practices
+  description: Logging levels, structured logging, mandatory events catalog, file rotation policy, and best practices
+
+# XSPEC-070 Phase 2 — skill↔standard content-coverage audit.
+# Consumed by scripts/check-skill-content-coverage.ts: the anchor skill
+# (logging-guide) MUST mention each mandatory event id below, or CONTENT-002 fires.
+# Source of truth: core/logging-standards.md "Mandatory Events" catalog (9 canonical events).
+audit:
+  mandatory_keywords:
+    - application_startup
+    - request_received
+    - validation_failure
+    - authentication_failure
+    - outbound_call_start
+    - outbound_call_complete
+    - business_event
+    - heartbeat
+    - shutdown
 
 log_levels:
   ordered:
@@ -51,6 +67,69 @@ structured_logging:
   field_naming: snake_case
   format: JSON in production
 
+# When you MUST write a log entry (XSPEC-234 / closes #108).
+# Compliant formatting but silent-at-the-critical-moment logging is excluded.
+mandatory_events:
+  - id: application_startup
+    when: After process boot, before accepting requests
+    level: INFO
+    must_log: [app_name, version, git_sha, environment, hostname, pid, listening_endpoints]
+    must_not_log: [secrets, full_connection_strings]
+    rationale: Lifecycle blind spot; confirms which build/config is actually live
+  - id: request_received
+    when: First time HTTP middleware sees a request
+    level: INFO/DEBUG
+    must_log: [method, path, source_ip, request_id]
+    must_not_log: [request_body, auth_headers]
+    rationale: Establishes request_id correlation from the edge inward
+  - id: validation_failure
+    when: schema / ModelState / DTO validation rejects
+    level: WARN
+    must_log: [request_id, path, missing_fields, payload_shape]
+    must_not_log: [field_values, pii]
+    rationale: Framework rejects before handler; payload otherwise never logged (incident #2)
+  - id: authentication_failure
+    when: login / token verification fails
+    level: WARN
+    must_log: [uid_attempted, source_ip, failure_reason]
+    must_not_log: [password, token_value]
+    rationale: 'Account or password error alone is un-investigable without uid/IP (incident #3)'
+  - id: outbound_call_start
+    when: An outbound HTTP/RPC call is initiated
+    level: INFO
+    must_log: [target_url_host_path, request_id_propagated, timeout_ms]
+    must_not_log: [credentials, bearer_tokens]
+    rationale: A send-failed error must leave a trace that the call was even attempted
+  - id: outbound_call_complete
+    when: An external call returns or fails
+    level: INFO/WARN/ERROR
+    must_log: [status_code_or_failure_phase, elapsed_ms, retries]
+    must_not_log: [response_body_with_pii]
+    rationale: Distinguish dns/tcp/tls/http failure phase for diagnosis
+  - id: business_event
+    when: A state-changing business operation completes
+    level: INFO
+    must_log: [operation_name, actor, target_ids, outcome]
+    must_not_log: [full_record_payload, pii]
+    rationale: Audit trail of what changed and by whom
+  - id: heartbeat
+    when: Long-running background service, at least once per 60 seconds
+    level: INFO
+    must_log: [service_name, queue_depth, items_processed_since_last_heartbeat]
+    must_not_log: []
+    rationale: Detect silent/0-byte background worker; enables silence detection (incident #4)
+  - id: shutdown
+    when: Process exits (graceful or fatal)
+    level: INFO/ERROR
+    must_log: [app_name, signal_or_reason, uptime_seconds, pending_work_count]
+    must_not_log: []
+    rationale: Lifecycle blind spot; reveals crash vs graceful and lost in-flight work
+
+mandatory_events_follow_on_rules:
+  access_log_separation: Health-probe/liveness traffic MUST NOT pollute business-event log (separate sink)
+  silence_detection_sla: Alert after N minutes with no events, N <= 2x heartbeat interval
+  request_id_discoverability: Error responses to client SHOULD carry request_id for support correlation
+
 sensitive_data:
   never_log:
     - passwords
@@ -80,6 +159,19 @@ rules:
     instruction: Use structured JSON logging with required fields
     priority: required
 
+  - id: mandatory-events
+    trigger: implementing startup/shutdown, request handling, validation, auth, outbound calls, background services
+    instruction: |
+      Emit the mandatory events catalog entries (see mandatory_events):
+      application_startup, request_received, validation_failure,
+      authentication_failure, outbound_call_start, outbound_call_complete,
+      business_event, heartbeat, shutdown. A log that follows every formatting
+      rule but never fires at the critical moment is excluded. Validation rejects
+      MUST log payload_shape (keys only, not values); auth failures MUST log
+      uid+source_ip (never password/token); background services MUST heartbeat
+      so silence is detectable.
+    priority: required
+
   - id: include-context
     trigger: logging operations
     instruction: Include request_id or trace_id for correlation
@@ -185,9 +277,11 @@ quick_reference:
 
 enforcement:
   hook_type: PostToolUse
+  trigger: PostToolUse
   matcher:
     tool: Write
     path: "src/**/*.ts"
   script_ref: "scripts/hooks/check-logging-standard.js"
+  hook_script: "scripts/hooks/check-logging-standard.js"
   severity: warning
   timeout_ms: 500

package/bundled/ai/standards/mock-boundary.ai.yaml

@@ -3,14 +3,17 @@
 
 id: mock-boundary
 meta:
-  version: "1.1.0"
-  updated: "2026-05-13"
+  version: "1.2.0"
+  updated: "2026-07-01"
   source: core/mock-boundary.md
   description: >
     Rules defining what can and cannot be mocked to prevent hollow tests —
     tests that pass while the real system is broken.
     v1.1.0: Added Level 1/Level 2 mock layer distinction and external
     dependency testability matrix template (XSPEC-204).
+    v1.2.0: Added injectable background execution as a seam (parallel to clock
+    injection) — allowed background-runner seam, no-poll/sleep rule, and the
+    poll/sleep-for-background-result anti-pattern (issue #143).
 
 # ─────────────────────────────────────────────────────────
 # Mock Levels (v1.1.0)
@@ -150,6 +153,31 @@ allowed:
       // 1. The DB layer has its own integration tests
       // 2. The service test focuses on service logic (not DB behavior)
 
+  - category: In-Process Background Execution (via injectable runner)
+    description: >
+      Fire-and-forget dispatch — Task.Run, unawaited promises, setTimeout,
+      goroutines, thread-pool/executor submission, asyncio.create_task
+    reason: >
+      Background dispatch is a seam, exactly like the system clock. Inject a
+      runner so the test can drive the work to deterministic, awaited completion
+      and assert on success/exception/retry — instead of polling or sleeping.
+    implementation: >
+      Abstract dispatch behind a small interface (e.g. IBackgroundTaskRunner /
+      BackgroundDispatcher). Production keeps true fire-and-forget semantics;
+      the test double runs the work inline and tracks the Task/promise, exposing
+      a handle the test can await before asserting.
+    example: |
+      // Production: real fire-and-forget — returns immediately, work runs detached
+      class FireAndForgetDispatcher implements BackgroundDispatcher {
+        dispatch(work: () => Promise<void>): void { void work() }
+      }
+      // Test: inline + tracked so the test can await deterministic completion
+      class DeterministicDispatcher implements BackgroundDispatcher {
+        private tasks: Promise<void>[] = []
+        dispatch(work: () => Promise<void>): void { this.tasks.push(work()) }
+        async settle(): Promise<void> { await Promise.all(this.tasks) }
+      }
+
 # ─────────────────────────────────────────────────────────
 # Forbidden Mocks
 # ─────────────────────────────────────────────────────────
@@ -253,6 +281,15 @@ anti_patterns:
     description: DB mock returns hardcoded data, hiding query logic errors
     problem: Schema migrations, wrong predicates, missing joins — all invisible
 
+  - name: Poll/Sleep for Background Result
+    description: >
+      Sleeping or polling to wait for in-process fire-and-forget work
+      (Task.Run, unawaited promise, setTimeout, goroutine) to finish
+    problem: >
+      The race is still there — the timeout only hides it most of the time while
+      slowing the whole suite; on a shared runner it leaks flakiness into other
+      MRs' CI. Same class of anti-pattern as depending on wall-clock time.
+
 # ─────────────────────────────────────────────────────────
 # Rules
 # ─────────────────────────────────────────────────────────
@@ -297,6 +334,15 @@ rules:
       If any hollow test indicator triggers, rewrite the mocking strategy.
     priority: required
 
+  - id: no-poll-sleep-for-background-work
+    trigger: test asserts a fire-and-forget side effect (Task.Run, unawaited promise, setTimeout, goroutine, executor)
+    instruction: >
+      Never poll or sleep to wait for in-process background work. Inject a
+      deterministic runner (e.g. IBackgroundTaskRunner / BackgroundDispatcher)
+      whose test double runs the work inline and tracks the Task/promise; await
+      the tracked task, then assert on success, exception, or retry.
+    priority: required
+
   - id: level-2-stub-server-rules
     trigger: UAT environment lacks a real external service (SMS, payment, IdP)
     instruction: >

package/bundled/ai/standards/model-provenance.ai.yaml

@@ -0,0 +1,297 @@
+# Model Provenance Policy Standards - AI Optimized
+# Sources:
+#   v1.0.0 — XSPEC-255 Model Provenance Policy (acceptable model source as an enforced axis)
+#            DEC-075 (neutral mechanism / policy belongs to customer)
+#            DEC-063 (regulated / data-sovereignty customers)
+
+id: model-provenance
+title: Model Provenance Policy Standards (Acceptable Model Source as a Governed, Fail-Closed Axis)
+version: "1.0.0"
+status: Active
+tags: [provenance, model-source, geopolitics, data-sovereignty, governance-gate, fail-closed, audit, allowlist, denylist, compliance]
+created: 2026-06-17
+updated: 2026-06-17
+
+spec_ref: XSPEC-255   # Model Provenance Policy complete spec
+
+references:
+  - XSPEC-255   # v1.0.0 source — Model Provenance Policy
+  - XSPEC-193   # Sibling governance-gate profile — licensing (shared skeleton)
+  - XSPEC-256   # Sibling governance-gate profile — correctness
+  - DEC-075     # Domain-neutral mechanism (policy content belongs to customer/pack)
+  - DEC-063     # Legal & compliance — regulated / sovereignty-sensitive customers
+  - DEC-064     # Customer IP isolation (per-customer policy scoping)
+  - DEC-066     # Telemetry-driven evolution — audit/telemetry allowlist
+  - DEC-076     # Self-serve north star — provenance = a self-serve ceiling
+  - XSPEC-254   # Positioning pre-mortem (cost-structure / origin axis context)
+
+summary: |
+  Model selection is not only "cost x quality" — there is a third axis: whether the model's
+  SOURCE is acceptable to the customer (geopolitics / data sovereignty / regulation). A
+  regulated or geopolitically sensitive buyer may be unable to use models from a given
+  jurisdiction; the strictest reject even locally-run open weights of that origin. This
+  standard makes model provenance a first-class, enforced, auditable property: declare an
+  acceptable-source policy, block non-compliant model choices fail-closed, and emit
+  auditable evidence ("this delivery used no models of the denied origin").
+
+  It is the PROVENANCE (source) member of the governance-gate family — alongside
+  license-compliance (XSPEC-193, licensing) and verification-oracle (XSPEC-256, correctness)
+  — sharing the same shape: registry/check -> fail-closed gate -> audit evidence ->
+  human-escalation ceiling. The three are profiles of one mechanism over three axes:
+  licensing / provenance / correctness.
+
+  REQ-001~007: a model origin registry (model -> vendor -> jurisdiction/origin class); a
+  provenance policy schema (allow/deny origins, local-weights distinction, mode,
+  unknown-origin fail-closed); fail-closed enforcement at every model-selection point;
+  auditable provenance evidence; reference policy packs (content customer-owned);
+  unknown-origin fail-closed; and policy content sovereignty (mechanism neutral, policy
+  owned by the customer).
+
+scope:
+  applies_to:
+    - Any system that selects an LLM/model where the customer constrains acceptable model source
+      (regulated / government / geopolitically sensitive buyers)
+    - Model-selection points: per-agent config, routing decisions, BYOK
+    - Provenance audit reports proving no denied-origin model was used
+  excludes:
+    - The policy CONTENT itself (which origins are acceptable) — owned by the customer / a compliance pack
+    - Enforcement-engine wiring (e.g. VibeOps provider abstraction / router gate) — downstream adoption concern
+    - Cost/quality model right-sizing — that is model-selection; provenance is a constraint applied first
+
+origin_registry:
+  description: |
+    Each known model is classified by vendor -> jurisdiction -> origin class. Like the
+    license-compliance license DB, it is maintainable and extensible by the ecosystem/customer.
+  origin_classes:
+    - western-frontier   # e.g. Claude (Anthropic/US), GPT/o-series (OpenAI/US), Gemini (Google/US)
+    - western-open       # e.g. Llama (Meta/US), Mistral (Mistral/EU), Gemma (Google/US)
+    - china-origin       # e.g. DeepSeek (DeepSeek/CN), MiniMax (MiniMax/CN), Qwen (Alibaba/CN)
+  example_entries:
+    - { model: Claude, vendor: Anthropic, jurisdiction: US, origin_class: western-frontier }
+    - { model: GPT, vendor: OpenAI, jurisdiction: US, origin_class: western-frontier }
+    - { model: Gemini, vendor: Google, jurisdiction: US, origin_class: western-frontier }
+    - { model: Llama, vendor: Meta, jurisdiction: US, origin_class: western-open }
+    - { model: Mistral, vendor: Mistral, jurisdiction: EU, origin_class: western-open }
+    - { model: Gemma, vendor: Google, jurisdiction: US, origin_class: western-open }
+    - { model: DeepSeek, vendor: DeepSeek, jurisdiction: CN, origin_class: china-origin }
+    - { model: MiniMax, vendor: MiniMax, jurisdiction: CN, origin_class: china-origin }
+    - { model: Qwen, vendor: Alibaba, jurisdiction: CN, origin_class: china-origin }
+
+policy_schema:
+  description: |
+    Per-project/per-customer provenance policy. Mechanism only — concrete values are
+    customer/pack-owned (DEC-075).
+  fields:
+    allow_origins: "list of origin classes that are permitted"
+    deny_origins: "list of origin classes that are blocked"
+    china_local_weights: "deny | allow_local_only — distinguishes foreign open weights run locally; strict buyers deny"
+    mode: "block | warn | require_human"
+    unknown_origin: "block (fail-closed default) | warn | require_human"
+  example: |
+    {
+      "allow_origins": ["western-frontier", "western-open"],
+      "deny_origins": ["china-origin"],
+      "china_local_weights": "deny",
+      "mode": "block",
+      "unknown_origin": "block"
+    }
+
+principles:
+  - id: P-1
+    name: Provenance is a Third Axis
+    description: |
+      Model choice is cost x quality x acceptable source. The source axis MUST be a
+      first-class constraint, not an afterthought, for regulated/sovereignty-sensitive buyers.
+
+  - id: P-2
+    name: Registry First
+    description: |
+      Every model MUST carry vendor/jurisdiction/origin class before a policy can act on it.
+      An unclassified model is "unknown origin" and falls under fail-closed handling (P-3).
+
+  - id: P-3
+    name: Fail-Closed
+    description: |
+      A denied or unknown origin MUST block or escalate. The check MUST NOT silently pass —
+      mirroring the license-compliance blocklist and verification-oracle non-reproduction block.
+
+  - id: P-4
+    name: Evidence-Based
+    description: |
+      Every generation MUST record the model used and its origin class, so a compliance report
+      ("no denied-origin model used") is producible with a reproducible trace and audit id.
+
+  - id: P-5
+    name: Human Ceiling
+    description: |
+      Ambiguous provenance or a require_human mode MUST escalate to a human (DEC-076 ceiling)
+      rather than auto-resolve — a product-enforced governance gate.
+
+  - id: P-6
+    name: Content Sovereignty
+    description: |
+      The mechanism is domain-neutral (DEC-075); the acceptable-source policy is owned by the
+      customer (DEC-063). Policies SHOULD be customer-scoped and isolated (DEC-064).
+
+requirements:
+  - id: REQ-001
+    title: Model Origin Registry (first-class artifact)
+    description: |
+      Each known model MUST be classified by vendor -> jurisdiction -> origin class. The
+      registry is maintainable/extensible by the ecosystem/customer (like the license DB).
+      At minimum origin classes distinguish western-frontier, western-open, and other origins
+      so a policy can be expressed against them.
+    level: MUST
+    examples:
+      - "Claude -> Anthropic / US / western-frontier"
+      - "Qwen -> Alibaba / CN / china-origin"
+      - "Llama -> Meta / US / western-open"
+
+  - id: REQ-002
+    title: Provenance Policy Schema
+    description: |
+      A per-project/per-customer policy MUST express allow/deny origins (by class), a
+      local-weights distinction (foreign API/data-egress vs locally-run foreign open weights),
+      an enforcement mode (block/warn/require_human), and an unknown_origin behaviour that is
+      fail-closed by default.
+    level: MUST
+    schema_fields:
+      - "allow_origins / deny_origins (by origin class)"
+      - "china_local_weights: deny | allow_local_only (strict buyers deny even local foreign weights)"
+      - "mode: block | warn | require_human"
+      - "unknown_origin: block (fail-closed default)"
+
+  - id: REQ-003
+    title: Fail-Closed Enforcement (every model-selection point)
+    description: |
+      At every model-selection point (per-agent config / routing / BYOK) the chosen model's
+      origin MUST be checked against the active policy. A violation MUST block or escalate
+      fail-closed — never silently pass. Enforcement runs before routing so a disallowed
+      source is swapped for an acceptable model.
+    level: MUST
+    checks:
+      - "Apply TW-finance-gov-style policy -> selecting DeepSeek/MiniMax/Qwen (incl. local) is blocked"
+      - "Selecting Llama/Claude under the same policy is allowed"
+      - "Injection test: route a denied-origin model -> gate blocks (never silent pass)"
+
+  - id: REQ-004
+    title: Audit Evidence
+    description: |
+      Each generation MUST record the model used + its origin class, enabling a compliance
+      report ("this delivery used no models of the denied origin"). It plugs into the audit
+      logger / hash chain, verification-oracle correctness evidence (XSPEC-256), and the
+      telemetry allowlist (DEC-066). This report is the outward proof of the provenance moat.
+    level: MUST
+    evidence_required:
+      - "per generation: model id + vendor + origin class"
+      - "policy applied (allow/deny snapshot)"
+      - "denied-origin count (expected 0 under a deny policy)"
+      - "content hash (sha256) of the report"
+      - "audit-trail id (hash-chain entry)"
+
+  - id: REQ-005
+    title: Reference Policy Pack(s)
+    description: |
+      The mechanism SHOULD ship a small number of reference policy packs that demonstrate it
+      (e.g. a pack denying a given origin including local weights). The mechanism is neutral;
+      concrete policy content is owned by the customer or a compliance partner.
+    level: SHOULD
+    examples:
+      - "Reference pack 'TW-finance-gov': deny china-origin including local weights"
+
+  - id: REQ-006
+    title: Unknown-Origin Fail-Closed
+    description: |
+      A model whose origin is not in the registry (unknown provenance) MUST NOT be silently
+      allowed. The system MUST treat unknown origin as a fail-closed block or escalation
+      (REQ-002 unknown_origin), consistent with the governance-gate no-silent-pass rule.
+    level: MUST
+    checks:
+      - "Unknown-origin model under unknown_origin:block -> blocked/escalated, not auto-allowed"
+      - "Injection test: present an unregistered model -> gate does not silently pass"
+
+  - id: REQ-007
+    title: Provenance Policy Content Sovereignty
+    description: |
+      The mechanism is domain-neutral (DEC-075); the acceptable-source policy is
+      customer-owned (DEC-063). Policies SHOULD be customer-scoped and isolated (DEC-064).
+    level: SHOULD
+    checks:
+      - "Policy scoping is per-customer; provenance verdicts attribute policy to the customer"
+      - "Mechanism carries no jurisdiction-specific allow/deny baked in (only the registry classes)"
+
+# ─────────────────────────────────────────────────────────────
+# Governance-gate family (shared shape with XSPEC-193 / XSPEC-256)
+# ─────────────────────────────────────────────────────────────
+
+governance_gate_family:
+  description: |
+    model-provenance is the PROVENANCE (source) profile of one governance-gate mechanism.
+    All profiles share: registry/check -> fail-closed gate -> audit evidence ->
+    customer-override-telemetered -> human-escalation ceiling.
+  profiles:
+    - profile: licensing
+      standard: license-compliance
+      spec: XSPEC-193
+      registry: blocklist/allowlist/greylist
+      block_trigger: prohibited license
+    - profile: provenance
+      standard: model-provenance
+      spec: XSPEC-255
+      registry: model origin registry + policy
+      block_trigger: denied / unknown origin
+    - profile: correctness
+      standard: verification-oracle
+      spec: XSPEC-256
+      registry: ground-truth registry
+      block_trigger: non-reproduction / drift
+
+# ─────────────────────────────────────────────────────────────
+# Gate timing
+# ─────────────────────────────────────────────────────────────
+
+gate_timing:
+  pre_routing: REQ-003 fail-closed provenance check at every model-selection point
+  on_denied_or_unknown: REQ-006 / P-5 block or escalate to human (no silent pass)
+  on_allowed: REQ-004 record model + origin
+  after_run: REQ-004 emit provenance audit / compliance report (outward moat proof)
+
+# ─────────────────────────────────────────────────────────────
+# Telemetry (DEC-066 / XSPEC-189 v2 envelope)
+# ─────────────────────────────────────────────────────────────
+
+telemetry:
+  required_events:
+    - model_provenance_check      # origin check outcome per model-selection point
+    - model_provenance_block      # fail-closed block detail (REQ-003)
+    - model_provenance_escalation # require_human / ambiguous provenance escalated (P-5)
+    - unknown_origin_detected     # unregistered model encountered (REQ-006)
+    - human_override_block        # human override of a block (requires reason)
+  envelope_reference: XSPEC-189   # Telemetry Schema v2 envelope
+  event_type: quality
+  event_subtype_examples:
+    - model_provenance_check
+    - gate_pass / gate_fail       # when the provenance check acts as a selection gate
+
+# ─────────────────────────────────────────────────────────────
+# Integration with existing standards
+# ─────────────────────────────────────────────────────────────
+
+integration:
+  license-compliance: sibling profile; shared allowlist/denylist + fail-closed + audit + override skeleton
+  verification-oracle: sibling profile; provenance evidence sits alongside correctness evidence in one report
+  model-selection: provenance is a constraint applied before cost/quality right-sizing (unacceptable source removed from candidate set)
+  security-standards: foreign-API data egress + local-weights distinction are data-sovereignty controls
+  verification-evidence: the provenance report is a kind of verification evidence (model + origin + no-denied-origin trace)
+
+# ─────────────────────────────────────────────────────────────
+# Adoption guidance
+# ─────────────────────────────────────────────────────────────
+
+adoption_guidance:
+  uds_install_path: ai/standards/model-provenance.ai.yaml
+  notes:
+    - "v1.0.0 defines the provenance mechanism and audit evidence. Policy content (acceptable origins) is customer-owned (DEC-075/DEC-063)."
+    - "Adopters MAY enforce the check in CI / at the provider abstraction without a bespoke engine."
+    - "Distinguish foreign-API access (data egress) from locally-run foreign open weights — strict buyers deny even local weights."
+    - "Group with license-compliance and verification-oracle as one governance-gate subsystem (three profiles)."