universal-dev-standards 5.17.0 → 6.0.0

package/bin/uds.js

@@ -13,18 +13,14 @@ import { configCommand } from '../src/commands/config.js';
 import { hitlCommand } from '../src/commands/hitl.js';
 import { skillsCommand } from '../src/commands/skills.js';
 import { agentListCommand, agentInstallCommand, agentInfoCommand } from '../src/commands/agent.js';
-import { workflowListCommand, workflowInstallCommand, workflowInfoCommand, workflowExecuteCommand, workflowStatusCommand } from '../src/commands/workflow.js';
 import { aiContextInitCommand, aiContextValidateCommand, aiContextGraphCommand } from '../src/commands/ai-context.js';
-import { sweepCommand } from '../src/commands/sweep.js';
 import { auditCommand } from '../src/commands/audit.js';
 import { uninstallCommand } from '../src/commands/uninstall.js';
 import { specCreateCommand, specListCommand, specShowCommand, specConfirmCommand, specArchiveCommand, specDeleteCommand, specSearchCommand } from '../src/commands/spec.js';
 import { quickstartCommand } from '../src/commands/quickstart.js';
 import { specSplitCommand } from '../src/commands/spec-split.js';
-import { startCommand, missionStatusCommand, missionPauseCommand, missionResumeCommand, missionCancelCommand, missionListCommand } from '../src/commands/start.js';
 import { releaseCommand } from '../src/commands/release.js';
 import { compileStandards } from '../src/commands/compile.js';
-import { flowCreateCommand, flowListCommand, flowValidateCommand, flowDiffCommand, flowExportCommand, flowImportCommand } from '../src/commands/flow.js';
 import { generateReport } from '../src/commands/report.js';
 import { mcpCommand } from '../src/commands/mcp.js';
 import { runIntentCommand } from '../src/commands/run-intent.js';
@@ -36,6 +32,17 @@ import { readManifest, isInitialized } from '../src/utils/copier.js';
 const require = createRequire(import.meta.url);
 const pkg = require('../package.json');
 
+// Non-UTF-8 Windows consoles (e.g. CP950/Big5 on zh-TW systems) render UTF-8
+// output as mojibake — switch the active code page before any output (#125)
+if (process.platform === 'win32') {
+  try {
+    const { execSync } = await import('node:child_process');
+    execSync('chcp 65001', { stdio: 'ignore' });
+  } catch {
+    // Best effort — cosmetic only, never block the CLI
+  }
+}
+
 /**
  * Perform update check and print notice if a newer version is available.
  * Resolves silently on error so it never breaks CLI flow.
@@ -216,14 +223,6 @@ program
   .description('List installed Claude Code skills')
   .action(skillsCommand);
 
-program
-  .command('sweep')
-  .description('Auto-cleanup code after vibe coding sessions')
-  .option('--fix', 'Apply fixes instead of dry-run preview')
-  .option('--report', 'Save report to .uds/reports/')
-  .option('-v, --verbose', 'Show detailed output')
-  .action(sweepCommand);
-
 program
   .command('audit')
   .description('Deep health diagnosis with pattern detection and feedback (strategic). For quick file check, use "uds check"')
@@ -231,6 +230,7 @@ program
   .option('--patterns', 'Pattern detection only')
   .option('--friction', 'Friction detection only')
   .option('--report', 'Interactive feedback submission')
+  .option('--yes', 'Submit all findings without interactive selection (CI / non-TTY)')
   .option('--dry-run', 'Preview report without submitting')
   .option('--gh', 'Force gh CLI for submission')
   .option('--format <format>', 'Output format (json)')
@@ -305,6 +305,7 @@ program
   .description('Manage release process (promote, deploy, manifest, verify)')
   .option('--result <result>', 'Test result for deploy command (passed/failed)')
   .option('--checksum <hash>', 'Package checksum for manifest command')
+  .option('--artifact <path>', 'Artefact file to verify against the manifest checksum (verify command)')
   .action(releaseCommand);
 
 // Spec command with subcommands (Vibe Coding)
@@ -398,47 +399,6 @@ agentCommand
   .description('Show detailed information about an agent')
   .action(agentInfoCommand);
 
-// Workflow command with subcommands
-const workflowCommand = program
-  .command('workflow')
-  .description('Manage UDS workflows for AI tools');
-
-workflowCommand
-  .command('list')
-  .description('List available and installed workflows')
-  .option('--installed', 'Show installation status for all AI tools')
-  .action(workflowListCommand);
-
-workflowCommand
-  .command('install [workflow-name]')
-  .description('Install workflows (specify name or "all" for all workflows)')
-  .option('-t, --tool <tool>', 'Target AI tool (default: claude-code)')
-  .option('-g, --global', 'Install to user level instead of project level')
-  .option('-y, --yes', 'Skip confirmation prompts')
-  .action(workflowInstallCommand);
-
-workflowCommand
-  .command('info <workflow-name>')
-  .description('Show detailed information about a workflow')
-  .action(workflowInfoCommand);
-
-workflowCommand
-  .command('execute <workflow-name>')
-  .alias('run')
-  .description('Execute a workflow step by step')
-  .option('-t, --tool <tool>', 'Target AI tool (default: claude-code)')
-  .option('--resume', 'Resume from saved state')
-  .option('--restart', 'Restart from beginning (discard saved state)')
-  .option('-v, --verbose', 'Show detailed output')
-  .option('--dry-run', 'Show steps without executing')
-  .option('-y, --yes', 'Skip confirmation prompts')
-  .action(workflowExecuteCommand);
-
-workflowCommand
-  .command('status [workflow-name]')
-  .description('Show execution status of workflows')
-  .action(workflowStatusCommand);
-
 // AI Context command with subcommands
 const aiContextCommand = program
   .command('ai-context')
@@ -463,88 +423,6 @@ aiContextCommand
   .option('-m, --mermaid', 'Output Mermaid diagram format')
   .action(aiContextGraphCommand);
 
-// Flow command with subcommands (SPEC-FLOW-001)
-const flowCommand = program
-  .command('flow')
-  .description('Manage custom SDLC flows');
-
-flowCommand
-  .command('create')
-  .description('Create a custom flow interactively')
-  .action(flowCreateCommand);
-
-flowCommand
-  .command('list')
-  .alias('ls')
-  .description('List all available flows (built-in + custom)')
-  .action(flowListCommand);
-
-flowCommand
-  .command('validate <id>')
-  .description('Validate a flow definition')
-  .action(flowValidateCommand);
-
-flowCommand
-  .command('diff <flow-a> <flow-b>')
-  .description('Compare two flows')
-  .action(flowDiffCommand);
-
-flowCommand
-  .command('export <id>')
-  .description('Export a flow as a shareable bundle')
-  .option('-o, --output <path>', 'Output file path')
-  .action(flowExportCommand);
-
-flowCommand
-  .command('import <file>')
-  .description('Import a flow bundle')
-  .option('-f, --force', 'Overwrite existing files')
-  .action(flowImportCommand);
-
-// Start command for mission-oriented development
-program
-  .command('start [mission-type] [intent]')
-  .description('Start a new development mission')
-  .option('-y, --yes', 'Skip confirmation prompts')
-  .option('--skip-planning', 'Skip automatic transition to planning phase')
-  .action(startCommand);
-
-// Mission command with subcommands
-const missionCommand = program
-  .command('mission')
-  .description('Manage development missions');
-
-missionCommand
-  .command('status')
-  .description('Show current mission status')
-  .action(missionStatusCommand);
-
-missionCommand
-  .command('pause')
-  .description('Pause current mission')
-  .option('-r, --reason <reason>', 'Reason for pausing')
-  .action(missionPauseCommand);
-
-missionCommand
-  .command('resume')
-  .description('Resume paused mission')
-  .action(missionResumeCommand);
-
-missionCommand
-  .command('cancel')
-  .description('Cancel current mission')
-  .option('-r, --reason <reason>', 'Reason for cancellation')
-  .option('-y, --yes', 'Skip confirmation')
-  .action(missionCancelCommand);
-
-missionCommand
-  .command('list')
-  .alias('ls')
-  .description('List all missions')
-  .option('-t, --type <type>', 'Filter by mission type')
-  .option('-s, --state <state>', 'Filter by state')
-  .action(missionListCommand);
-
 // MCP command for AI tool integration
 mcpCommand(program);
 

package/bundled/ai/standards/acceptance-criteria-traceability.ai.yaml

@@ -7,7 +7,7 @@ standard:
   description: AC-to-test traceability matrix, coverage calculation, and spec generation quality rules
 
   meta:
-    version: "1.0.0"
+    version: "1.1.0"
     updated: "2026-03-18"
     source: core/acceptance-criteria-traceability.md
     references:
@@ -16,6 +16,14 @@ standard:
       - "ISTQB Foundation (Requirements-based testing)"
       - "INVEST Principles (Acceptance criteria quality)"
 
+  # XSPEC-070 Phase 2 — skill↔standard content-coverage audit.
+  # Consumed by scripts/check-skill-content-coverage.ts. v1.1.0 mandates the
+  # combined "canonical annotation" `@SPEC-<id> @AC-<n>`; the anchor skill
+  # (ac-coverage) MUST teach that term, or CONTENT-002 fires.
+  audit:
+    mandatory_keywords:
+      - canonical annotation
+
   traceability_matrix:
     description: Standard format for tracking AC to test relationships
     fields:
@@ -36,10 +44,11 @@ standard:
         description: Additional context (blockers, dependencies)
 
     linking_convention:
-      description: Tests must reference source AC using standard annotations
+      description: Tests must reference source AC using the canonical combined annotation
+      canonical: "@SPEC-<id> @AC-<n> — single combined tag on one line, e.g. @SPEC-001 @AC-1"
+      note: "Do not split into separate @AC / @SPEC lines; forward-derivation and tag filters consume the combined form"
       annotations:
-        - "@AC AC-N — in test name or comment"
-        - "@SPEC SPEC-XXX — in test name or comment"
+        - "@SPEC-001 @AC-1 — in test name or comment (canonical, parallel)"
         - "describe('AC-N: description') — in test structure"
 
   coverage_status:

package/bundled/ai/standards/accessibility-standards.ai.yaml

@@ -1,6 +1,6 @@
 # Accessibility Standards (AI-Optimized)
 # Source: core/accessibility-standards.md
-# Version: 1.0.0
+# Version: 1.1.0
 
 target: "WCAG 2.1 Level AA"
 

package/bundled/ai/standards/ai-response-navigation.ai.yaml

@@ -3,8 +3,8 @@
 
 id: ai-response-navigation
 meta:
-  version: "1.0.0"
-  updated: "2026-03-25"
+  version: "1.1.0"
+  updated: "2026-06-10"
   source: core/ai-response-navigation.md
   description: Every substantive AI response must include contextual next-step suggestions with recommended options
 
@@ -64,6 +64,19 @@ rules:
       but ensure format consistency — use blockquote, recommendation marking, and appropriate template.
     priority: recommended
 
+  - id: model-tier-annotation
+    trigger: a next-step option clearly maps to a specific task complexity tier
+    instruction: >
+      OPTIONALLY append a model tier annotation after the option description:
+      〔model: Fast〕, 〔model: Standard〕, or 〔model: Capable〕.
+      Use complexity signals from the model-selection standard to determine the tier:
+      Fast = single file, unambiguous spec; Standard = 2-5 files, inter-module judgment;
+      Capable = 5+ files, architectural decisions.
+      Tier names are vendor-neutral — each tool maps them to available models independently.
+      Existing skills do not need retroactive updates; new and revised skills are encouraged to adopt.
+      Localized notation: 〔模型：Fast〕 / 〔模型：Standard〕 / 〔模型：Capable〕
+    priority: optional
+
 related_standards:
   - ai-command-behavior
   - ai-instruction-standards

package/bundled/ai/standards/api-design-standards.ai.yaml

@@ -13,8 +13,8 @@ standard:
     - "Always require HTTPS"
 
   meta:
-    version: "1.0.0"
-    updated: "2026-03-18"
+    version: "1.1.0"
+    updated: "2026-06-24"
     source: core/api-design-standards.md
     description: Comprehensive API design guidelines for REST, GraphQL, and gRPC
 
@@ -60,10 +60,30 @@ standard:
       header: {example: "Accept-Version: v1", pros: "clean URLs", cons: "hidden, harder to test"}
       query_param: {example: "?v=1", pros: "easy to add", cons: "caching issues"}
     lifecycle:
+      # States only; period numbers are owned by deprecation-standards (single source).
       current: "Full support, new features"
-      supported: "6-12 months, bug/security fixes only"
-      deprecated: "3-6 months notice, sunset header"
+      supported: "Maintained in parallel with successor; bug/security fixes only"
+      deprecated: "Retirement announced; Deprecation/Sunset headers, migration guide"
       retired: "Return 410 Gone"
+      periods_source: "core/deprecation-standards.md#api-deprecation"
+    backward_compatibility:
+      # Breaking → requires MAJOR bump (see versioning.md#incrementing-rules)
+      breaking:
+        - Remove a public API endpoint
+        - Remove a required request field
+        - Add a required request field
+        - Change a response field's type
+        - Change the meaning of an error code
+        - Remove a response field consumers depend on
+      safe:  # MINOR or PATCH
+        - Add an optional request field
+        - Add a new response field
+        - Add a new endpoint
+        - Add a new error code
+        - Improve an error message
+        - Performance improvement
+    deprecation: "Lifecycle, per-tier notice periods, Sunset process → core/deprecation-standards.md#api-deprecation"
+    migration_guide: "On a breaking MAJOR, publish a v1→v2 guide mapping each old usage to its replacement"
 
   pagination:
     strategies:
@@ -160,6 +180,9 @@ rules:
   - id: REST-004
     rule: "Version APIs via URL path (/v1/) and maintain version lifecycle (current → deprecated → retired)"
     severity: warning
+  - id: REST-009
+    rule: "Classify every change before release: breaking changes (remove/retype/required fields, error-code meaning) require a MAJOR bump; additive changes ship as MINOR/PATCH. Deprecation periods follow deprecation-standards"
+    severity: error
   - id: REST-005
     rule: "Include rate limiting headers (X-RateLimit-Limit, Remaining, Reset) on all responses"
     severity: warning

package/bundled/ai/standards/behavior-snapshot.ai.yaml

@@ -7,12 +7,13 @@ standard:
   description: Multi-modal golden file format for migration parity verification and refactoring characterization; supports HTTP, CLI, File, and Event adapters; defines snapshot schema, parity gate, and Gate 0 protocol
 
   meta:
-    version: "1.1.0"
-    updated: "2026-05-13"
+    version: "1.2.0"
+    updated: "2026-06-28"
     source: core/behavior-snapshot.md
     references:
       - "XSPEC-201: Refactor/Migration Completeness Protocol"
       - "XSPEC-203: Language Pack Architecture (multi-modal adapter extension)"
+      - "XSPEC-306: Oracle Comparison Fidelity & Serialization-Format Parity"
       - "Michael Feathers: Working Effectively with Legacy Code (characterization tests)"
       - "Golden Master Testing pattern"
 
@@ -169,15 +170,73 @@ standard:
         - background job/queue-triggered flows
 
   ignore_fields_guidance:
-    always_ignore:
-      - created_at, updated_at, timestamp, recorded_at
-      - token, session_id, csrf_token, access_token, refresh_token
-      - request_id, trace_id, correlation_id
+    core_principle: |
+      Ignore the VALUE, keep the FORMAT assertion. A non-deterministic field has a
+      value that changes between runs — its SHAPE is not free to change. Dropping the
+      whole field (naive ignore_fields) also stops asserting its format, so a serializer
+      that silently switches ISO-8601 to epoch, drops the timezone, or changes UUID
+      version/casing passes unnoticed.
+    ignore_value_assert_format:
+      - field: created_at, updated_at, timestamp
+        ignore: the instant
+        still_assert: "ISO-8601 vs epoch vs custom; fractional-second precision (digits); timezone representation (Z vs +00:00 vs offset)"
+      - field: token, session_id, csrf_token, access_token, refresh_token
+        ignore: the random bytes
+        still_assert: "length, charset, prefix"
+      - field: request_id, trace_id, correlation_id
+        ignore: the random UUID
+        still_assert: "UUID version + canonical 8-4-4-4-12 shape and casing"
     always_compare:
       - status, code, message, error_code
       - user_id, order_id (when using fixed test data)
       - amount, quantity, price (business calculation results)
       - "success, refunded, cancelled (boolean business outcomes)"
+    whole_field_ignore:
+      status: "exception — requires justification"
+      when_acceptable: "field format is genuinely unspecified or irrelevant (e.g. an opaque vendor blob); document the reason inline"
+      risk: "masks FORMAT drift — timestamp precision/timezone, UUID version, or a number gaining/losing a trailing zero passes silently"
+
+  serialization_format_parity:
+    description: |
+      A differential oracle that compares only DESERIALIZED objects normalizes
+      serialization-level differences away. To catch serialization bugs, compare at a
+      granularity that preserves the serialized form: compare the RAW serialized string,
+      or explicitly assert the JSON shape.
+    hidden_by_object_compare:
+      - "1 vs 1.0 (number format) — both parse to number 1"
+      - "null vs missing key — both read as absent/null"
+      - "true vs 1 vs \"true\" — after type coercion"
+      - "key ordering — object keys are unordered"
+      - "leading zeros / scientific notation — normalized on parse"
+      - "whitespace and Unicode escaping (\\/ , \\uXXXX) — lost on parse"
+    strategies:
+      raw_string: "compare the exact serialized string — strongest fidelity; use when the wire format is contractual (public API, cached payloads, signed bodies)"
+      json_shape_assertions:
+        - "key presence and order (when order is contractual)"
+        - "number format: 1 vs 1.0, leading zeros, scientific notation"
+        - "null vs absent key (omitted field != explicit null)"
+        - "boolean/string type: true vs \"true\" vs 1"
+    cross_language_defaults:
+      note: "rewriting in another language swaps the serializer; serializers differ in DEFAULTS — assert these explicitly"
+      php_json_encode_vs_csharp_system_text_json:
+        - concern: number trailing zeros
+          php: "(float)1.0 emits 1; JSON_PRESERVE_ZERO_FRACTION needed to keep 1.0"
+          csharp: "double 1.0 serializes as 1; decimal preserves scale"
+        - concern: date/time
+          php: "no native date type — app-defined (custom string or epoch)"
+          csharp: "DateTime/DateTimeOffset -> ISO-8601 round-trip 'O', e.g. 2026-05-12T08:30:00+00:00"
+        - concern: timezone
+          php: "app-defined"
+          csharp: "DateTimeOffset keeps offset; DateTime.Kind decides Z vs offset"
+        - concern: null properties
+          php: "included as \"k\":null"
+          csharp: "included by default; omitted only with DefaultIgnoreCondition.WhenWritingNull"
+        - concern: key ordering
+          php: "insertion order (associative array)"
+          csharp: "property-declaration / reflection order"
+        - concern: slash and unicode escaping
+          php: "escapes / and non-ASCII unless JSON_UNESCAPED_SLASHES / JSON_UNESCAPED_UNICODE"
+          csharp: "does not escape /; escapes non-ASCII per configured encoder"
 
   parity_gate:
     description: CI gate comparing new system responses against recorded snapshots
@@ -225,10 +284,27 @@ standard:
     - id: ignore-fields-discipline
       trigger: creating or reviewing snapshot ignore_fields
       instruction: |
-        Only add fields to ignore_fields if they are legitimately non-deterministic
-        (timestamps, tokens, random IDs). Business logic fields must always be compared.
-        Overuse of ignore_fields defeats the purpose of parity testing.
+        Ignore the VALUE, keep the FORMAT assertion. Only add fields to ignore_fields if
+        they are legitimately non-deterministic (timestamps, tokens, random IDs) — and even
+        then, still assert the field's format/shape (ISO-8601 pattern, UUID version, token
+        charset/prefix). Whole-field ignore (no value AND no format assertion) is an
+        exception that requires justification because it masks format drift. Business logic
+        fields must always be compared. Overuse of ignore_fields defeats parity testing.
+      priority: required
+      anti_pattern: "Whole-field ignore on a non-deterministic field — masks timestamp precision/timezone or UUID-version drift"
+
+    - id: serialization-format-parity
+      trigger: differential oracle comparing serialized output (JSON etc.)
+      instruction: |
+        Do NOT compare only deserialized objects — parsing normalizes away serialization
+        bugs (1 vs 1.0, null vs missing key, key order, true vs 1, leading zeros, escaping).
+        Compare the RAW serialized string, or assert the JSON shape explicitly (key presence/
+        order, number format, null vs absent, boolean/string type). On cross-language rewrites
+        the serializer changes (e.g. PHP json_encode vs C# System.Text.Json have different
+        defaults for trailing zeros, dates, timezone, null omission, key order, escaping) —
+        assert these explicitly because nothing else will.
       priority: required
+      anti_pattern: "Comparing only the deserialized object — serialization-format bugs are invisible after parse"
 
     - id: manual-snapshots
       trigger: snapshot cannot be auto-recorded
@@ -270,3 +346,4 @@ related_standards:
   - acceptance-criteria-traceability.ai.yaml
   - refactoring-standards.ai.yaml
   - testing.ai.yaml
+  - data-migration-testing.ai.yaml  # same "don't compare what merely looks equal" principle, at the DB storage layer

package/bundled/ai/standards/checkin-standards.ai.yaml

@@ -12,8 +12,8 @@ standard:
     - "Documentation: docs updated, CHANGELOG updated"
 
   meta:
-    version: "2.0.0"
-    updated: "2026-02-04"
+    version: "2.1.0"
+    updated: "2026-06-18"
     source: core/checkin-standards.md
     description: Quality gates that must be passed before committing code
 

package/bundled/ai/standards/code-review.ai.yaml

@@ -12,8 +12,8 @@ standard:
     - "Be constructive and explain 'why'"
 
   meta:
-    version: "2.0.0"
-    updated: "2026-02-04"
+    version: "2.1.0"
+    updated: "2026-06-18"
     source: core/code-review-checklist.md
     description: Systematic checklist for reviewing code quality and security
 

package/bundled/ai/standards/context-aware-loading.ai.yaml

@@ -66,7 +66,7 @@ standard:
     quality:
       description: Standards for code review, refactoring, and quality assurance
       triggers:
-        - "/review"
+        - "/code-review"
         - "/refactor"
         - "/check"
         - "code review"
@@ -148,7 +148,7 @@ standard:
         Map slash commands to domains:
         /tdd, /bdd, /atdd, /coverage → testing
         /sdd, /spec, /derive, /reverse, /requirement → specification
-        /review, /refactor, /check → quality
+        /code-review, /refactor, /check → quality
         /docs, /changelog, /generate-docs → documentation
         /release, /commit → workflow
       priority: required
@@ -157,7 +157,7 @@ standard:
       trigger: "user invokes a UDS slash command, Skill, or UDS-related operation"
       instruction: >
         When the user invokes a UDS-related slash command (/commit, /sdd,
-        /review, /release, /tdd, /bdd, /docs, /changelog, etc.) or uses
+        /code-review, /release, /tdd, /bdd, /docs, /changelog, etc.) or uses
         a UDS Skill for the FIRST TIME in the current conversation,
         check for UDS updates:
 

package/bundled/ai/standards/data-migration-testing.ai.yaml

@@ -3,10 +3,10 @@
 
 id: data-migration-testing
 meta:
-  version: "1.0.0"
-  updated: "2026-05-05"
+  version: "1.1.0"
+  updated: "2026-06-27"
   source: core/data-migration-testing.md
-  description: Database migration up/down/idempotency testing standards for schema changes
+  description: Database migration up/down/idempotency testing standards for schema changes, plus encoding-conversion and aggregate-invariant testing for cross-encoding/cross-engine migrations
 
 requirements:
   REQ-1:
@@ -63,6 +63,33 @@ requirements:
       Shared migration state between tests causes non-deterministic failures that are
       extremely difficult to diagnose.
 
+  REQ-6:
+    id: REQ-DMT-006
+    title: Encoding Conversion Test
+    rule: >
+      Migrations that cross encodings or DB engines (e.g. UTF-8 -> UTF-16/NVARCHAR,
+      VARCHAR -> NVARCHAR, or an implicit collation change) MUST include a test that
+      asserts equality at the BYTE / codepoint / normalization level — not display
+      level. Cover NFC vs NFD normalization, multi-byte boundaries, and CJK / emoji /
+      combining marks (supplementary-plane codepoints).
+    rationale: >
+      Two different byte or normalization sequences can decode to glyphs that look
+      identical, so a display-level (toBe) assertion passes while the stored bytes —
+      and downstream LIKE / unique-key / collation behavior — are silently corrupted.
+
+  REQ-7:
+    id: REQ-DMT-007
+    title: Aggregate Invariant Test
+    rule: >
+      Migrations of business-critical data MUST capture aggregate invariants
+      (COUNT(*), SUM(column), COUNT(DISTINCT key), checksum) grouped by a business
+      dimension BEFORE the migration and assert they are unchanged AFTER. Same oracle
+      as post-cutover production reconciliation, run at migration-test time.
+    rationale: >
+      Row-by-row sampling proves individual rows survived but not that the distribution
+      survived; a single wrong SUM/COUNT/DISTINCT flags drift that any sample missing
+      the affected rows would not catch.
+
 test_structure:
   isolation: "Each migration test MUST run against an isolated in-memory or temp DB"
   baseline: "Start from the schema state immediately before the migration under test"
@@ -71,6 +98,48 @@ test_structure:
     down: "Assert schema returns to pre-migration state"
     idempotency: "Apply migration twice; second apply must succeed without error"
     data: "Seed rows before migration; assert row count and values after"
+    encoding: "Assert byte/codepoint/normalization identity (Buffer compare + spread-to-codepoints + normalize), NOT display-level toBe; cover NFC/NFD, multi-byte boundaries, CJK/emoji/combining marks"
+    aggregate: "Capture COUNT/SUM/COUNT(DISTINCT)/checksum grouped by business dimension before; assert deep-equal after"
+
+cross_dialect_risks:
+  description: "SQLite -> SQL Server semantic disagreements; derive-list input for encoding/aggregate tests and the non-HTTP implicit-rule scan"
+  rows:
+    - point: Type system
+      sqlite: Dynamic typing (per-value affinity)
+      sqlserver: Static / strong typing
+      verify: Declare per-column type; scan for out-of-range / mixed-type values
+    - point: Boolean
+      sqlite: Stored as 0/1 integer
+      sqlserver: BIT
+      verify: 0/1 <-> BIT mapping; NULL boolean handling
+    - point: Date/time
+      sqlite: TEXT / REAL / INTEGER
+      sqlserver: datetime2 / datetimeoffset
+      verify: Format parse, time-zone, precision truncation
+    - point: Auto-increment PK
+      sqlite: AUTOINCREMENT
+      sqlserver: IDENTITY
+      verify: Existing id continuity; correct seed/reseed
+    - point: Case / collation
+      sqlite: LIKE case-insensitive by default / NOCASE
+      sqlserver: Determined by column collation
+      verify: Align collation; check unique-key folding collisions
+    - point: NULL ordering
+      sqlite: NULLs sort first (smallest)
+      sqlserver: Depends on configuration
+      verify: ORDER BY result-order invariant
+    - point: Float precision
+      sqlite: REAL
+      sqlserver: float / decimal
+      verify: Move money/exact values to decimal to avoid rounding error
+    - point: String concat
+      sqlite: "||"
+      sqlserver: "+ / CONCAT"
+      verify: Rewrite queries; reconcile NULL-concat semantics
+    - point: Pagination
+      sqlite: LIMIT / OFFSET
+      sqlserver: OFFSET..FETCH / TOP
+      verify: Rewrite + stable sort key for deterministic pages
 
 tooling_guidance:
   sqlite: "Use ':memory:' DSN; apply migrations via ORM migrate() or raw SQL"
@@ -89,6 +158,13 @@ anti_patterns:
   - description: >
       Writing migration tests after the fact without seeding data — misses the
       data preservation class of bugs entirely.
+  - description: >
+      Asserting string equality only on the decoded value — display-level equality
+      passes even when bytes, normalization form, or codepoints were corrupted across
+      an encoding/engine change.
+  - description: >
+      Validating a cross-engine migration with row sampling alone — distribution-level
+      drift (a wrong SUM/COUNT/DISTINCT) escapes any sample that misses the affected rows.
 
 related_standards:
   - testing

package/bundled/ai/standards/deprecation-standards.ai.yaml

@@ -3,8 +3,8 @@
 
 id: deprecation-standards
 meta:
-  version: "1.0.0"
-  updated: "2026-03-31"
+  version: "1.1.0"
+  updated: "2026-06-24"
   source: core/deprecation-standards.md
   description: API deprecation, feature sunset, system decommission lifecycle
 
@@ -21,6 +21,14 @@ api_deprecation:
     sunset: "Sunset: Sat, 31 Dec 2026 23:59:59 GMT"
     successor: 'Link: <url>; rel="successor-version"'
   parallel_period: "≥6 months after new GA, or 3 months after last consumer migrates"
+  # Single source of truth for deprecation periods (consolidated from versioning.md,
+  # XSPEC-298 R8 / UDS #126). Sunset timeline above = default public-API cadence.
+  # Apply the LONGER of the tier minimum and parallel_period.
+  minimum_period_by_tier:
+    internal_api: "1 minor version"
+    partner_api: "2 minor versions + 3 months"
+    public_api: "2 minor versions + 6 months"
+    critical_infrastructure: "1 year minimum"
 
 notification_channels:
   - "CHANGELOG / Release Notes"