universal-dev-standards 5.16.0 → 6.0.0

package/bundled/ai/standards/security-testing.ai.yaml

@@ -3,8 +3,8 @@
 
 id: security-testing
 meta:
-  version: "1.0.0"
-  updated: "2026-05-04"
+  version: "1.1.0"
+  updated: "2026-06-19"
   source: core/security-testing.md
   description: >
     Security testing methodology covering SAST, dependency auditing, and DAST.
@@ -126,6 +126,17 @@ cve_policy:
     - Get security lead approval
     - Add to `.npmrc` / `audit-exceptions.json` with comment
 
+# Finding remediation lifecycle (XSPEC-292 T16): every finding (SAST/DAST/secret/CVE)
+finding_lifecycle:
+  states:
+    - "Detected: scanning gate (CI) raised it -> severity assigned"
+    - "Triaged: security reviewer confirms real vs false-positive -> In-Progress or suppressed (recorded)"
+    - "In-Progress: component code owner implements fix -> fix committed"
+    - "Resolved: fix merged -> originating scan re-runs clean"
+    - "Verified: scanning gate confirms finding gone -> closed"
+  gate: "Critical/High in any state except Verified (or Triaged->suppressed with justification) blocks release"
+  no_silent_close: "Leave only via Verified (re-scan clean) or recorded suppressed decision by security reviewer; never by deletion or fix-author self-approval"
+
 # ─────────────────────────────────────────────────────────
 # Rules
 # ─────────────────────────────────────────────────────────

package/bundled/ai/standards/skill-standard-alignment-check.ai.yaml

@@ -7,8 +7,8 @@ standard:
   description: Skill 必有 Standard 作為錨點，Standard 可無 Skill；定期識別孤兒 Skill
 
   meta:
-    version: "1.0.0"
-    updated: "2026-04-17"
+    version: "1.1.0"
+    updated: "2026-06-19"
     status: trial
     since: "2026-04-17"
     expires: "2026-10-17"
@@ -76,6 +76,36 @@ standard:
     step_5: "若 anchor_standard 指向不存在的 id 或已 Archived 的 id → 錯誤"
     output: "alignment-report.json / alignment-report.md（含 orphan 清單、broken anchor 清單）"
 
+  content_coverage_audit:
+    phase: 2
+    source: "XSPEC-292 T4（3 個真實 skill↔standard 內容漂移）"
+    script: "scripts/check-skill-content-coverage.ts (npm check:content-coverage)"
+    rationale: >
+      Phase 1 只證明 anchor 存在（防 orphan）。Skill 可帶有效 anchor_standard 仍漂移：
+      標準新增 mandatory 段落、bump 版本、或成長到遠超 Skill 的陳舊摘要。
+      Phase 2 把對齊從「錨點存在」延伸到「錨點內容同步」。
+    checks:
+      version_skew:
+        code: CONTENT-001
+        rule: "Skill **Version** < anchor 標準版本（取自 core/<id>.md）→ stale"
+        unversioned: "Skill 無版本 → CONTENT-001A（advisory only，永不阻擋）"
+      mandatory_keyword:
+        code: CONTENT-002
+        rule: "標準在 .ai.yaml 宣告的 audit.mandatory_keywords 未出現於 Skill 內文 → 報缺"
+        anti_hallucination: "審核器不臆測 mandatory，只讀標準作者明文宣告的清單"
+      size_ratio:
+        code: CONTENT-003
+        rule: "Skill 行數 / 標準行數 < audit.min_skill_ratio（預設 0.15）→ underspecified"
+    audit_declaration:
+      where: "標準 .ai.yaml 的頂層 audit: 或 standard.audit:（兩種 schema 皆支援）"
+      fields:
+        mandatory_keywords: "string[]（case-insensitive 子字串比對 Skill 內文）"
+        min_skill_ratio: "number（選填，覆寫預設 0.15）"
+    enforcement:
+      default: "advisory（列出 finding，exit 0，讓 audit 先落地）"
+      strict: "--strict 將 CONTENT-001/002/003 升為阻擋（exit 1）；CONTENT-001A 永不阻擋"
+      rollout: "先 advisory 進 CI 觀察 → 漂移清零後 pre-release gate 加 --strict"
+
   scenarios:
     scenario_1_skill_with_valid_anchor:
       given: "retry-assistant Skill frontmatter 含 anchor_standard: retry-standards"
@@ -111,6 +141,11 @@ standard:
     ALIGN-002: "BROKEN_ANCHOR — anchor_standard 指向不存在的 standard id"
     ALIGN-003: "ARCHIVED_ANCHOR — anchor_standard 指向已 Archived 的標準"
     ALIGN-004: "UTILITY_MISSING_REASON — utility Skill 標 anchor_standard=none 但缺 utility_reason"
+    CONTENT-001: "VERSION_SKEW — Skill 版本 < anchor 標準版本（stale；blocking under --strict）"
+    CONTENT-001A: "SKILL_UNVERSIONED — Skill 無版本，無法比對（advisory only）"
+    CONTENT-002: "MISSING_MANDATORY_KEYWORD — 標準宣告的 mandatory keyword 未出現於 Skill"
+    CONTENT-003: "UNDERSPECIFIED — Skill 規模遠小於 anchor 標準"
+    CONTENT-000: "ANCHOR_NOT_IN_REGISTRY — 內容覆蓋無法評估（broken anchor 屬 ALIGN-002）"
 
   integration_points:
     - "standard-admission-criteria.ai.yaml — orphan Skill 促成新 Standard 申請"

package/bundled/ai/standards/user-journey-testing.ai.yaml

@@ -0,0 +1,107 @@
+# User Journey Testing Standard - AI Optimized
+# 使用者旅程測試標準：定義 TESTPLAN 格式，讓跨 Story 的連貫使用者旅程成為測試一等公民
+
+standard:
+  id: user-journey-testing
+  name: User Journey Testing Standard
+  description: Defines TESTPLAN format for connected, sequential user journey tests
+
+  meta:
+    version: "1.0.0"
+    updated: "2026-05-03"
+    source: core/user-journey-testing.md
+    description: TESTPLAN format for connected, sequential user journey tests
+
+  guidelines:
+    - "Every project MUST have at least one TESTPLAN-NNN.md documenting the main user journey"
+    - "TESTPLAN steps MUST be sequential and stateful — each step depends on prior state"
+    - "Every TESTPLAN MUST define personas before test steps"
+    - "TESTPLAN and automated E2E tests MUST use the same T-NNN identifiers"
+    - "Journey E2E tests MUST skip gracefully when environment is unavailable"
+    - "Journey tests cover what AC tests cannot: cross-story state continuity"
+
+  testplan_format:
+    file_naming: "TESTPLAN-NNN-<project-slug>.md"
+    location: "test-plans/"
+    sections:
+      personas:
+        required: true
+        description: "Define all test actors with their role and permissions"
+        format: "| Actor | Role | Key Permissions |"
+      environment:
+        required: true
+        description: "List environment prerequisites and verification commands"
+      test_groups:
+        required: true
+        description: "T-NNN numbered test groups with sequential dependency chain"
+      execution_order:
+        required: true
+        description: "Dependency diagram showing T-NNN → T-NNN relationships"
+
+  step_markers:
+    "[UI]": "Browser-based action, verify visually"
+    "[API]": "curl / API client verification"
+    "[CHECK]": "Expected result to confirm"
+    "[SKIP-if]": "Conditional skip with reason"
+    "★": "High-risk step requiring confirmation"
+
+  step_format:
+    fields:
+      - step_id: "T-NNN-M (group-step format)"
+      - operation: "What to do, with [MARKER]"
+      - expected_result: "What should happen"
+    precondition: "State from previous T-NNN that must be satisfied"
+    depends_on: "Comma-separated T-NNN identifiers"
+
+  automation_mapping:
+    principle: "Every T-NNN group maps to a describe() block; every step maps to an it()"
+    file_pattern: "*.journey.spec.ts or *.journey.e2e.test.ts"
+    shared_state: "Journey tests MUST use shared let variables across it() blocks"
+    skip_strategy: "Use describe.skipIf(!BASE_URL) for environment-dependent tests"
+
+  journey_categories:
+    - id: platform-admin-journey
+      description: "Platform admin setup: login → org → project → pipeline"
+      required_for: ["enterprise", "saas"]
+    - id: member-journey
+      description: "Org member: join → project access → pipeline view"
+      required_for: ["enterprise", "saas"]
+    - id: dev-journey
+      description: "Developer: new project → spec → pipeline → artifact"
+      required_for: ["all"]
+
+  rules:
+    - id: testplan-required
+      trigger: creating a new project
+      instruction: Generate TESTPLAN-001.md with personas, environment, and main journey steps before writing code
+      priority: required
+
+    - id: journey-before-code
+      trigger: starting project implementation
+      instruction: Define the user journey test plan first; journey tests act as living acceptance criteria
+      priority: recommended
+
+    - id: sequential-state
+      trigger: writing journey E2E tests
+      instruction: Use shared state variables (let token, orgSlug, projectSlug) so each test step builds on previous results
+      priority: required
+
+    - id: graceful-skip
+      trigger: writing journey E2E tests
+      instruction: Guard with describe.skipIf(!process.env.JOURNEY_BASE_URL) so tests are skipped in unit CI
+      priority: required
+
+    - id: t-nnn-alignment
+      trigger: writing any E2E test
+      instruction: Reference T-NNN identifiers from TESTPLAN in test descriptions for traceability
+      priority: recommended
+
+    - id: persona-first
+      trigger: writing TESTPLAN
+      instruction: Define all user personas before writing any test steps
+      priority: required
+
+    - id: dependency-chain
+      trigger: writing TESTPLAN
+      instruction: Each test group must declare its depends_on list so execution order is explicit
+      priority: required

package/bundled/ai/standards/verification-oracle.ai.yaml

@@ -0,0 +1,278 @@
+# Verification Oracle Standards - AI Optimized
+# Sources:
+#   v1.0.0 — XSPEC-256 Verification Oracle (correctness as a maintained invariant)
+#            DEC-077 (mother decision: "correct" is a maintained invariant, the moat axis)
+
+id: verification-oracle
+title: Verification Oracle Standards (Ground-Truth Correctness as a Maintained Invariant)
+version: "1.0.0"
+status: Active
+tags: [correctness, oracle, ground-truth, verification, governance-gate, fail-closed, audit, regression, re-verification, ci-invariant]
+created: 2026-06-17
+updated: 2026-06-17
+
+spec_ref: XSPEC-256   # Verification Oracle complete spec
+
+references:
+  - XSPEC-256   # v1.0.0 source — Verification Oracle
+  - DEC-077     # Mother decision — correctness as a maintained invariant
+  - DEC-075     # Domain-neutral mechanism (oracle content belongs to customer)
+  - DEC-076     # Self-serve north star — oracle = self-serve ceiling
+  - DEC-063     # Legal & compliance — customer-owned output / high-stakes
+  - DEC-066     # Telemetry-driven evolution — audit/telemetry allowlist
+  - DEC-064     # Customer IP isolation (per-customer registry salt)
+  - XSPEC-193   # Sibling governance-gate profile — licensing
+  - XSPEC-255   # Sibling governance-gate profile — provenance
+  - XSPEC-252   # Oracle manufacturing (Tier-4 hand-off)
+  - XSPEC-188   # UAT ship-decision dashboard (business-level UAT anchors)
+  - XSPEC-201   # Behavior-snapshot = an oracle instance
+
+summary: |
+  A test oracle is the source of truth that decides whether software output is correct.
+  Software without an oracle cannot be said to be "right". This standard makes the
+  ground-truth oracle a first-class artifact and turns "correct" from a one-time
+  acceptance state into a maintained invariant re-verified on every change (DEC-077).
+
+  It is the CORRECTNESS member of the governance-gate family — alongside license-compliance
+  (XSPEC-193, licensing) and model-provenance (XSPEC-255, provenance) — sharing the same
+  shape: registry/check -> fail-closed gate -> audit evidence -> human-escalation ceiling.
+  The three are profiles of one mechanism over three axes: licensing / provenance / correctness.
+
+  REQ-001~007: ground-truth registry bound to AC; oracle-ability grading (Tier 1-4); a
+  fail-closed pre-ship verification gate; sustained re-verification on every change with
+  drift detection; auditable evidence (N/N reproduced + no-drift + trace); a self-serve
+  frontier ceiling that escalates unverifiable high-stakes paths to a human; and oracle
+  content sovereignty (mechanism neutral, correct answers owned by the customer).
+
+scope:
+  applies_to:
+    - High-stakes features where correctness is verifiable against a ground-truth oracle
+      (billing / calculation / compliance / rules / data transformation)
+    - Generated or refactored systems that must reproduce known-correct outputs
+    - Acceptance evidence and audit reports proving correctness over time
+  excludes:
+    - Low-stakes software with no oracle and no correctness stake (over-design; see DEC-077)
+    - The oracle CONTENT itself (correct answers) — owned by the customer, not this standard
+    - Enforcement-engine wiring (e.g. VibeOps pipeline gate) — downstream adoption concern
+
+oracle_ability_spectrum:
+  description: |
+    Grade each high-stakes feature by how readily its oracle exists. Drives cost,
+    beachhead selection, and the Tier-4 hand-off to oracle manufacturing (XSPEC-252).
+  tiers:
+    - tier: 1
+      shape: Known-correct output of a legacy system
+      readiness: Most ready, cheapest (parity-provable)
+    - tier: 2
+      shape: A batch of hand-computed / existing correct outputs
+      readiness: Ready (reproduce + scale)
+    - tier: 3
+      shape: Regulation / formula (rules exist, examples missing)
+      readiness: Needs co-derived worked examples + sign-off (ATDD)
+    - tier: 4
+      shape: Vague requirement (oracle must be mined from interviews)
+      readiness: Most expensive — the translation problem (XSPEC-252 pulls toward 1-2)
+
+principles:
+  - id: P-1
+    name: Oracle First
+    description: |
+      No oracle, no "correct". Every claim of correctness MUST be grounded in an oracle,
+      and every high-stakes feature MUST be graded for oracle-ability before correctness
+      is asserted. Where no oracle exists, escalate (P-5) rather than guess.
+
+  - id: P-2
+    name: Maintained Invariant
+    description: |
+      "Correct" is not a one-time acceptance state but an invariant re-verified on every
+      change (DEC-077). Drift (was-correct, now-wrong) is a blocking event, not a warning.
+
+  - id: P-3
+    name: Fail-Closed
+    description: |
+      Non-reproduction of any ground-truth case MUST block ship or escalate. The gate MUST
+      NOT silently pass — mirroring the license-compliance blocklist and model-provenance
+      denylist behaviour.
+
+  - id: P-4
+    name: Evidence-Based
+    description: |
+      Every verdict MUST carry a reproducible trace: cases reproduced (N/N), per-case
+      input -> expected vs actual diff, content hash, and an audit-trail id. Verdicts
+      without evidence are prohibited.
+
+  - id: P-5
+    name: Human Ceiling
+    description: |
+      Defining correctness and signing off acceptance are human judgments (customer /
+      legal / regulator). Unverifiable high-stakes paths MUST escalate to a human
+      (DEC-076 ceiling) — a product-enforced governance gate, not a consultant trap.
+
+  - id: P-6
+    name: Content Sovereignty
+    description: |
+      The verification mechanism is domain-neutral (DEC-075); the correct answers are
+      owned by the customer (DEC-063). Registries SHOULD be customer-scoped and isolated
+      (DEC-064 salt).
+
+requirements:
+  - id: REQ-001
+    title: Ground-Truth Registry (first-class artifact)
+    description: |
+      Customer-provided correct answers become a first-class artifact. Each case carries
+      an input scenario + expected correct output and is bound to the acceptance criterion
+      it proves (acceptance-criteria-traceability). At minimum the mechanism MUST support
+      numeric and structured-output comparison, with per-field exemptions (ignore_fields).
+      The expected output is the CORRECT result, not merely "endpoint returned HTTP 200".
+    level: MUST
+    examples:
+      - "Billing case: given {orders, org_state} -> expected correct charge $0 (no double-charge)"
+      - "Case bound to AC-7 'no duplicate charge on retry' via acceptance-criteria-traceability"
+      - "Structured compare with ignore_fields:[created_at,request_id] to exclude volatile fields"
+
+  - id: REQ-002
+    title: Oracle-ability Grading (Tier 1-4)
+    description: |
+      Every high-stakes feature MUST be tagged with its oracle Tier (1-4). A Tier-4
+      (must-mine) feature MUST have a defined hand-off point to an oracle-manufacturing
+      flow (interview / Prototype Probe, XSPEC-252) that pulls the expensive end toward
+      Tier 1-2. Beachhead selection SHOULD prefer Tier 1-2.
+    level: MUST
+    examples:
+      - "Feature 'legacy billing parity' graded Tier 1 (legacy known-correct outputs exist)"
+      - "Feature 'discretionary discount policy' graded Tier 4 -> XSPEC-252 manufacturing hand-off"
+
+  - id: REQ-003
+    title: Fail-Closed Verification Gate (pre-ship)
+    description: |
+      Before entering UAT/ship, the system MUST exactly reproduce every registered
+      ground-truth case. A non-reproduction MUST block ship or escalate — never silently
+      pass. The gate plugs into existing reviewer/QA gates and the audit logger.
+    level: MUST
+    checks:
+      - "All registry cases must reproduce (N/N) before ship is allowed"
+      - "Any non-reproduction -> block ship OR escalate_to_human; never silent pass"
+      - "Injection test: deliberately corrupt one expected value -> gate blocks"
+
+  - id: REQ-004
+    title: Sustained Re-Verification (correctness as CI invariant)
+    description: |
+      On every change/regeneration the full oracle suite MUST be re-run, making correct a
+      CI-grade invariant. Drift (was-correct, now-wrong) MUST be detected and blocked.
+      This mechanizes DEC-077 ("changed and still correct, provably correct throughout").
+    level: MUST
+    checks:
+      - "Change/regeneration triggers a full re-run of the oracle suite"
+      - "Drift (previously reproduced case now failing) -> detect and block (regression oracle)"
+      - "Regression test: introduce drift -> detected and blocked"
+
+  - id: REQ-005
+    title: Audit Evidence
+    description: |
+      Each run MUST emit an auditable report: reproduced N/N, no drift, trace attached.
+      It plugs into the audit logger / hash chain, model-provenance source evidence
+      (XSPEC-255), and the telemetry allowlist (DEC-066). This report is the outward proof
+      of the correctness/governance moat and a customer compliance artifact.
+    level: MUST
+    evidence_required:
+      - "cases reproduced count (N/N)"
+      - "per-case: scenario, input, expected, actual, diff on mismatch"
+      - "drift status (none / list of drifted case ids)"
+      - "content hash (sha256) of the report"
+      - "audit-trail id (hash-chain entry)"
+
+  - id: REQ-006
+    title: Self-Serve Frontier Ceiling
+    description: |
+      Where no oracle exists (correctness not decidable) or a high-stakes path is
+      unverifiable, self-serve MUST NOT silently pass. The system MUST flag "human must
+      decide / oracle must be supplied" and escalate (DEC-076 ceiling).
+    level: MUST
+    checks:
+      - "Feature with no oracle MUST NOT auto-ship — flag needs-human and escalate"
+      - "Injection test: an oracle-less high-stakes feature is not auto-shipped"
+
+  - id: REQ-007
+    title: Oracle Content Sovereignty
+    description: |
+      The mechanism is domain-neutral (DEC-075); the correct answers are customer-owned
+      (DEC-063). Registries SHOULD be customer-scoped and isolated (DEC-064 salt).
+    level: SHOULD
+    checks:
+      - "Registry scoping is per-customer; correctness verdicts attribute content to the customer"
+      - "Mechanism carries no domain-specific correctness logic baked in"
+
+# ─────────────────────────────────────────────────────────────
+# Governance-gate family (shared shape with XSPEC-193 / XSPEC-255)
+# ─────────────────────────────────────────────────────────────
+
+governance_gate_family:
+  description: |
+    verification-oracle is the CORRECTNESS profile of one governance-gate mechanism.
+    All profiles share: registry/check -> fail-closed gate -> audit evidence ->
+    customer-override-telemetered -> human-escalation ceiling.
+  profiles:
+    - profile: licensing
+      standard: license-compliance
+      spec: XSPEC-193
+      registry: blocklist/allowlist/greylist
+      block_trigger: prohibited license
+    - profile: provenance
+      standard: model-provenance (planned sibling)
+      spec: XSPEC-255
+      registry: model source policy
+      block_trigger: denied source
+    - profile: correctness
+      standard: verification-oracle
+      spec: XSPEC-256
+      registry: ground-truth registry
+      block_trigger: non-reproduction / drift
+
+# ─────────────────────────────────────────────────────────────
+# Gate timing
+# ─────────────────────────────────────────────────────────────
+
+gate_timing:
+  pre_ship: REQ-003 fail-closed gate — reproduce all ground-truth before UAT/ship
+  on_every_change: REQ-004 re-run full oracle suite — drift blocks
+  after_run: REQ-005 emit audit evidence report (outward moat proof)
+  on_unverifiable: REQ-006 escalate to human (no silent pass)
+
+# ─────────────────────────────────────────────────────────────
+# Telemetry (DEC-066 / XSPEC-189 v2 envelope)
+# ─────────────────────────────────────────────────────────────
+
+telemetry:
+  required_events:
+    - oracle_verification_result   # N/N reproduction outcome per run
+    - oracle_drift_detected        # was-correct, now-wrong (REQ-004)
+    - oracle_gate_block            # fail-closed block detail (REQ-003)
+    - oracle_escalation            # unverifiable high-stakes escalated (REQ-006)
+    - human_override_block         # human override of a block (requires reason)
+  envelope_reference: XSPEC-189    # Telemetry Schema v2 envelope
+  event_type: quality
+  event_subtype_examples:
+    - oracle_verification_result
+    - gate_pass / gate_fail        # when the oracle gate acts as a ship gate
+
+# ─────────────────────────────────────────────────────────────
+# Integration with existing standards
+# ─────────────────────────────────────────────────────────────
+
+integration:
+  acceptance-criteria-traceability: oracle cases bind to AC; reproduction is a form of AC coverage
+  verification-evidence: the oracle report is a kind of verification evidence (N/N + no-drift + trace)
+  test-governance: the oracle suite is governed test policy; the gate is a governed gate
+  behavior-snapshot: parity/snapshot gate = REQ-003/REQ-004 for the refactor/migration case (a snapshot is an oracle)
+
+# ─────────────────────────────────────────────────────────────
+# Adoption guidance
+# ─────────────────────────────────────────────────────────────
+
+adoption_guidance:
+  uds_install_path: ai/standards/verification-oracle.ai.yaml
+  notes:
+    - "v1.0.0 defines the correctness oracle mechanism and acceptance evidence. Oracle content (correct answers) is customer-owned (DEC-075/DEC-063)."
+    - "Adopters MAY enforce the gate via CI (reproduce ground-truth on every change) without a bespoke engine."
+    - "Tier-4 (must-mine) features need an oracle-manufacturing hand-off (XSPEC-252) before correctness can be claimed."
+    - "Group with license-compliance and model-provenance as one governance-gate subsystem (three profiles)."

package/bundled/ai/standards/versioning.ai.yaml

@@ -13,8 +13,8 @@ standard:
     - "Use pre-release identifiers (alpha, beta, rc)"
 
   meta:
-    version: "2.0.0"
-    updated: "2026-02-04"
+    version: "2.2.0"
+    updated: "2026-07-01"
     source: core/versioning.md
     description: Semantic Versioning (SemVer) for software releases
 
@@ -82,42 +82,14 @@ standard:
         - Breaking changes allowed in MINOR versions
         - Move to 1.0.0 when API is stable
 
-  deprecation:
-    timeline:
-      internal_api: 1 minor version
-      partner_api: 2 minor versions + 3 months
-      public_api: 2 minor versions + 6 months
-      critical_infrastructure: 1 year minimum
-    backward_compatibility:
-      breaking_changes:
-        - Remove public API endpoints
-        - Remove required request fields
-        - Add required request fields
-        - Change response field types
-        - Change error code meanings
-        - Remove response fields consumers depend on
-      safe_changes:
-        - Add optional request fields
-        - Add new response fields
-        - Add new endpoints
-        - Add new error codes
-        - Improve error messages
-        - Performance improvements
-
-  api_versioning_strategies:
-    - strategy: URL Path
-      format: "/api/v1/users"
-      pros: Clear, easy routing
-      cons: URL pollution
-      recommended: true
-    - strategy: Query Parameter
-      format: "/api/users?version=1"
-      pros: Optional versioning
-      cons: Cache issues
-    - strategy: Header
-      format: "Accept: application/vnd.api.v1+json"
-      pros: Clean URLs
-      cons: Less visible
+  # API versioning strategies, the backward-compatibility checklist, deprecation
+  # timeline + per-tier periods, and the migration-guide template were moved to
+  # their single sources of truth (XSPEC-298 R8, UDS #126):
+  #   - api-design.ai.yaml  → versioning_strategies.backward_compatibility
+  #   - deprecation-standards.ai.yaml → api_deprecation.minimum_period_by_tier
+  cross_references:
+    api_contract: "core/api-design-standards.md#api-versioning-strategies"
+    deprecation_lifecycle: "core/deprecation-standards.md#api-deprecation"
 
   release_process:
     phases:
@@ -149,6 +121,7 @@ standard:
         check_items:
           - Service running normally
           - API returns correct version
+          - "Build-identity endpoint (/version or /health) returns commit sha matching the deployed artifact (not just version)"
           - No fatal errors in logs
           - Functionality verification passed
 
@@ -177,6 +150,27 @@ standard:
       trigger: deploying upgrade
       instruction: Must not skip dry-run test
       priority: required
+    - id: git-height-versioning-polyglot
+      trigger: choosing version automation for a polyglot / .NET / JVM project
+      instruction: >
+        Use git-height-derived versioning (MinVer / Nerdbank.GitVersioning / GitVersion)
+        so the version is derived from git tag + commit height and collisions are
+        structurally impossible; reserve semantic-release / standard-version for Node/npm
+        projects
+      priority: recommended
+    - id: build-identity-must-expose-sha
+      trigger: deploying a service
+      instruction: >
+        Deployed services MUST expose build identity (version + commit sha + build time)
+        via a queryable endpoint (/version or embedded in /health); the sha MUST be
+        verifiable against the deployed artifact, not self-reported
+      priority: required
+    - id: verify-sha-post-release
+      trigger: post-release verification
+      instruction: >
+        Assert the build-identity endpoint returns a commit sha matching the deployed
+        artifact, not merely the correct version number
+      priority: required
 
 physical_spec:
   type: custom_script

package/bundled/core/acceptance-criteria-traceability.md

@@ -2,6 +2,8 @@
 
 > **Language**: English | [繁體中文](../locales/zh-TW/core/acceptance-criteria-traceability.md)
 
+**Version**: 1.1.0
+**Last Updated**: 2026-06-19
 **Applicability**: All software projects using specification-driven or test-driven workflows
 **Scope**: universal
 
@@ -45,13 +47,15 @@ Acceptance Criteria Traceability Standards define how to track the relationship
 
 ### Linking Convention
 
-Tests MUST reference their source AC using standard annotations:
+Tests MUST reference their source AC using the **canonical annotation**:
+`@SPEC-<id> @AC-<n>` — a single combined tag, e.g. `@SPEC-001 @AC-1`. Keeping the
+attribution on one line is what forward-derivation and test-runner tag filters
+consume; **do not** split it into separate `@AC` / `@SPEC` lines.
 
 ```typescript
 // TypeScript/JavaScript
 describe('AC-1: User login with valid credentials', () => {
-  // @AC AC-1
-  // @SPEC SPEC-001
+  // @SPEC-001 @AC-1
   it('should redirect to dashboard on successful login', () => { ... });
 });
 ```
@@ -60,8 +64,7 @@ describe('AC-1: User login with valid credentials', () => {
 # Python
 class TestAC1_UserLogin:
     """AC-1: User login with valid credentials
-    @AC AC-1
-    @SPEC SPEC-001
+    @SPEC-001 @AC-1
     """
     def test_redirect_to_dashboard(self): ...
 ```
@@ -72,6 +75,13 @@ class TestAC1_UserLogin:
 Scenario: User login with valid credentials
 ```
 
+> **Key naming (by design, not a conflict).** `acceptance-criteria` (kebab-case)
+> is the human / identifier spelling — doc titles, standard ids, AI-format keys.
+> `acceptance_criteria` (snake_case) is the YAML **serialization** field (e.g.
+> `structured-task-definition`). `acceptanceCriteria` (camelCase) is not used.
+> These are layer-appropriate spellings (see the glossary's field-naming table)
+> and are **not** unified.
+
 ---
 
 ## Coverage Status Definitions

package/bundled/core/accessibility-standards.md

@@ -2,8 +2,8 @@
 
 > **Language**: English | [繁體中文](../locales/zh-TW/core/accessibility-standards.md)
 
-**Version**: 1.0.0
-**Last Updated**: 2026-01-29
+**Version**: 1.1.0
+**Last Updated**: 2026-06-18
 **Applicability**: All software projects with user interfaces
 **Scope**: universal
 **Industry Standards**: WCAG 2.1/2.2, WAI-ARIA 1.2, Section 508
@@ -213,8 +213,11 @@ This standard defines comprehensive guidelines for creating accessible software
 
 ```javascript
 // ✅ Good: Session timeout warning
-const TIMEOUT_WARNING = 5 * 60 * 1000; // 5 minutes before timeout
-const SESSION_TIMEOUT = 30 * 60 * 1000; // 30 minutes
+// A warning + a way to extend the session is REQUIRED by WCAG 2.2.1 (Timing
+// Adjustable). The specific durations are UDS defaults and are configurable:
+// 30 min idle aligns with NIST SP 800-63B AAL2 reauthentication guidance.
+const TIMEOUT_WARNING = 5 * 60 * 1000; // 5 min warning before timeout
+const SESSION_TIMEOUT = 30 * 60 * 1000; // 30 min idle (UDS default; configurable)
 
 setTimeout(() => {
   const extend = confirm('Your session will expire in 5 minutes. Extend?');
@@ -909,6 +912,7 @@ The a11y gate contributes to the Release Readiness Sign-off as:
 
 | Version | Date | Changes |
 |---------|------|---------|
+| 1.1.0 | 2026-06-18 | Added: source + configurable note for session-timeout durations (WCAG 2.2.1 Timing Adjustable; NIST SP 800-63B AAL2) (XSPEC-292 T8) |
 | 1.0.0 | 2026-01-29 | Initial release: WCAG 2.1 coverage, POUR principles, ARIA guidelines, keyboard navigation, forms, testing |
 
 ---

package/bundled/core/ai-friendly-architecture.md

@@ -5,7 +5,7 @@
 **Version**: 1.0.0
 **Last Updated**: 2026-01-21
 **Applicability**: All software projects collaborating with AI assistants
-**Scope**: partial
+**Scope**: universal
 **Industry Standards**: None (Emerging AI collaboration practice)
 
 ---