universal-dev-standards 5.17.0 → 6.0.0

package/bundled/locales/zh-CN/core/supply-chain-attestation.md

@@ -0,0 +1,131 @@
+---
+source: ../../../core/supply-chain-attestation.md
+source_version: 1.0.0
+translation_version: 1.0.0
+last_synced: 2026-06-10
+source_hash: f2d6deb8373b
+status: current
+---
+
+# 供应链证明（Attestation）标准
+
+> **语言**: [English](../../../core/supply-chain-attestation.md) | [繁體中文](../../zh-TW/core/supply-chain-attestation.md) | 简体中文
+
+## 概述
+
+软件供应链攻击（如 SolarWinds、Log4Shell 扩散）利用「原本打算交付的内容」与「实际交付的内容」之间的差距。SBOM + SLSA provenance 通过建立从 source commit 到部署制品之间可验证的链条来弥合这一差距。
+
+## SBOM（Software Bill of Materials，软件物料清单）
+
+CycloneDX JSON 格式是推荐采用的 SBOM 标准（SPDX 也受支持）。
+
+### 生成
+
+```bash
+# Install CycloneDX npm plugin
+npm install -g @cyclonedx/cyclonedx-npm
+
+# Generate from package-lock.json (NOT package.json)
+cyclonedx-npm --output-format JSON \
+              --output-file sbom.cdx.json \
+              --package-lock-only
+```
+
+### 验证
+
+```bash
+# Count components
+jq '.components | length' sbom.cdx.json
+
+# Check for GPL licences
+jq '.components[] | select(.licenses[].license.id | test("GPL"))' sbom.cdx.json
+```
+
+## SLSA Provenance
+
+[SLSA（Supply chain Levels for Software Artefacts）](https://slsa.dev) 定义了四个等级：
+
+| 等级 | 要求 |
+|-------|-------------|
+| L1 | Provenance 存在，自签名 |
+| L2 | Provenance 托管，由托管构建服务签名（GitHub Actions OIDC） |
+| L3 | Provenance 来自加固、完全隔离的构建平台 |
+| L4 | 双方评审 + hermetic builds |
+
+**推荐最低标准：内部发布采用 SLSA L1**，**公开发布采用 L2**。
+
+### SLSA L1 Provenance（GitHub Actions）
+
+```yaml
+- name: Generate SLSA L1 provenance
+  run: |
+    IMAGE_DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' "your-app:commercial-${VERSION}" 2>/dev/null || echo "N/A")
+    cat > provenance.json << PROVEOF
+    {
+      "_type": "https://in-toto.io/Statement/v0.1",
+      "predicateType": "https://slsa.dev/provenance/v0.2",
+      "subject": [{"name": "app-commercial-${VERSION}", "digest": {"sha256": "$(sha256sum app-commercial-${VERSION}.tar.gz | cut -d' ' -f1)"}}],
+      "predicate": {
+        "buildType": "https://github.com/Attestations/GitHubActionsWorkflow@v1",
+        "builder": {"id": "https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"},
+        "invocation": {
+          "configSource": {
+            "uri": "git+https://github.com/${GITHUB_REPOSITORY}",
+            "digest": {"sha1": "${GITHUB_SHA}"},
+            "entryPoint": ".github/workflows/release-commercial.yml"
+          }
+        },
+        "metadata": {
+          "buildInvocationId": "${GITHUB_RUN_ID}/${GITHUB_RUN_ATTEMPT}",
+          "buildStartedOn": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+          "completeness": {"environment": false, "materials": true, "parameters": false}
+        }
+      }
+    }
+    PROVEOF
+```
+
+### Cosign 签名
+
+```yaml
+- name: Sign SBOM and provenance
+  run: |
+    cosign sign-blob --key env://COSIGN_PRIVATE_KEY --yes sbom.cdx.json > sbom.cdx.json.sig
+    cosign sign-blob --key env://COSIGN_PRIVATE_KEY --yes provenance.json > provenance.json.sig
+  env:
+    COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+    COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+```
+
+### 验证（由最终用户执行）
+
+```bash
+# Verify SBOM signature
+cosign verify-blob --key cosign.pub --signature sbom.cdx.json.sig sbom.cdx.json
+
+# Verify provenance signature
+cosign verify-blob --key cosign.pub --signature provenance.json.sig provenance.json
+```
+
+## 发布包结构
+
+```
+app-commercial-v1.3.0/
+├── app-commercial-v1.3.0.docker.tar.gz   # Primary artefact
+├── sbom.cdx.json                              # CycloneDX SBOM
+├── sbom.cdx.json.sig                          # cosign signature
+├── provenance.json                            # SLSA L1 provenance
+├── provenance.json.sig                        # cosign signature
+├── checksums.txt                              # SHA-256 of all artefacts
+├── checksums.txt.sig                          # cosign signature
+└── install.sh / docker-compose.yml / ...
+```
+
+## 相关标准
+
+- [Supply Chain Security Standards](supply-chain-security-standards.md) — 依赖审计策略
+- [Container Security Standards](container-security.md) — 镜像加固
+- [Advanced SAST Standards](sast-advanced.md) — 静态分析
+
+
+**范围**: universal

package/bundled/locales/zh-CN/core/versioning.md

@@ -3,7 +3,7 @@ source: ../../../core/versioning.md
 source_version: 1.2.0
 translation_version: 1.2.0
 last_synced: 2026-01-08
-status: current
+status: stale
 ---
 
 > **语言**: [English](../../../core/versioning.md) | [简体中文](../../zh-TW/core/versioning.md) | 简体中文

package/bundled/locales/zh-CN/docs/CHEATSHEET.md

@@ -1,8 +1,8 @@
 # UDS 速查表
 
-> Quick reference for all UDS features | Last updated: 2026-05-14
+> Quick reference for all UDS features | Last updated: 2026-06-20
 
-**Language**: [English](../../../docs/CHEATSHEET.md) | [繁體中文](../../zh-TW/docs/CHEATSHEET.md) | 简体中文
+**Language**: [English](../../../docs/user/CHEATSHEET.md) | [繁體中文](../../zh-TW/docs/CHEATSHEET.md) | 简体中文
 
 ---
 
@@ -34,6 +34,7 @@
 | `/check` | [UDS] Verify standards adoption status |
 | `/checkin` | "[UDS] Pre-commit quality gates verification" |
 | `/ci-cd` | "[UDS] Guide CI/CD pipeline design, configuration and optimization" |
+| `/code-review` | [UDS] Perform systematic code review with checklist |
 | `/commit` | [UDS] Generate commit messages following Conventional Commits standard |
 | `/config` | [UDS] Configure project development standards |
 | `/coverage` | [UDS] Analyze test coverage and provide recommendations |
@@ -52,6 +53,7 @@
 | `/guide` | [UDS] Access Universal Development Standards guides and references. |
 | `/incident` | "[UDS] Guide incident response, root cause analysis and post-mortem documentation" |
 | `/init` | [UDS] Initialize development standards in current project |
+| `/journey-test` | [UDS] Generate coherent user journey test plans (TESTPLAN) and E2E skeletons from a project description. |
 | `/methodology` | [UDS] Manage development methodology workflow |
 | `/metrics` | "[UDS] Track development metrics, code quality indicators and project health" |
 | `/migrate` | "[UDS] Guide code migration, framework upgrades and technology modernization" |
@@ -64,12 +66,12 @@
 | `/reverse-sdd` | [UDS] Reverse engineer code into SDD specification document |
 | `/reverse-tdd` | [UDS] Analyze BDD-TDD coverage gaps |
 | `/reverse` | [UDS] Reverse engineer code to Specs, BDD, or TDD coverage. |
-| `/review` | [UDS] Perform systematic code review with checklist |
 | `/runbook` | "[UDS] Guide runbook creation, maintenance, drills, and coverage reporting" |
 | `/scan` | "[UDS] Guide automated security scanning, dependency auditing and secret detection" |
 | `/sdd-retro` | [UDS] Create retroactive specs for untracked feat/fix commits |
 | `/sdd` | [UDS] Create or review specification documents for Spec-Driven Development |
 | `/security` | "[UDS] Guide security review and vulnerability assessment following OWASP standards" |
+| `/skill-builder` | [UDS] Identify repeated processes and build Skills with the right development depth. |
 | `/slo` | "[UDS] Guide SLI selection, SLO setting, and Error Budget management" |
 | `/tdd` | [UDS] Guide through Test-Driven Development workflow |
 | `/update` | [UDS] Update development standards to latest version |
@@ -85,7 +87,7 @@
 | `ai-instruction-standards` | Create and maintain AI instruction files (CLAUDE.md, AGENTS. |
 | `api-design-assistant` | Guide API design following REST, GraphQL, and gRPC best prac |
 | `atdd-assistant` | "[UDS] Guide through Acceptance Test-Driven Development work |
-| `audit-assistant` | "[UDS] UDS Health & Feedback System \| UDS 健康檢查與回饋系統" |
+| `audit-assistant` | "[UDS] UDS Health & Feedback System" |
 | `bdd-assistant` | "[UDS] Guide through Behavior-Driven Development workflow" |
 | `brainstorm-assistant` | "[UDS] Structured AI-assisted brainstorming before spec crea |
 | `changelog-guide` | "[UDS] Generate and maintain CHANGELOG.md entries" |
@@ -105,7 +107,8 @@
 | `error-code-guide` | Design consistent error codes following the PREFIX_CATEGORY_ |
 | `git-workflow-guide` | Guide Git branching strategies, branch naming, and merge ope |
 | `incident-response-assistant` | Guide incident response, root cause analysis, and post-morte |
-| `journey-test-assistant` | "[UDS] 從專案描述生成連貫使用者旅程測試計畫（TESTPLAN）與 E2E 骨架" |
+| `journey-test-assistant` | "[UDS] Generate coherent user journey test plans (TESTPLAN)  |
+| `knowledge-graph` | "[UDS] Trace spec/decision/code impact chains via a knowledg |
 | `logging-guide` | Implement structured logging with proper log levels and sens |
 | `metrics-dashboard-assistant` | "[UDS] Track development metrics, code quality indicators, a |
 | `migration-assistant` | "[UDS] Guide code migration, framework upgrades, and technol |
@@ -120,7 +123,7 @@
 | `release-standards` | "[UDS] Guide release process and changelogs" |
 | `requirement-assistant` | "[UDS] Write user stories and requirements following INVEST  |
 | `retrospective-assistant` | [UDS] Guide structured team retrospectives for Sprint and Re |
-| `reverse-engineer` | "[UDS] System archeology — reverse engineer code across Logi |
+| `reverse-engineer` | "[UDS] System archeology - reverse engineer code across Logi |
 | `runbook-assistant` | Guide runbook creation, maintenance, and drill exercises. |
 | `security-assistant` | Guide security review and vulnerability assessment following |
 | `security-scan-assistant` | Guide automated security scanning, dependency auditing, and  |
@@ -174,6 +177,7 @@
 | `anti-hallucination` | This standard defines strict guidelines for AI ass |
 | `anti-sycophancy-prompting` | This standard defines techniques and rules for des |
 | `api-design-standards` | This standard defines comprehensive guidelines for |
+| `audit-trail` | Audit Trail Standards |
 | `behavior-driven-development` | Behavior-Driven Development (BDD) Standards |
 | `behavior-snapshot` | Behavior Snapshot Standard |
 | `branch-completion` | Define a standardized workflow for completing deve |
@@ -188,13 +192,16 @@
 | `circuit-breaker` | Circuit Breaker Standard |
 | `code-review-checklist` | This standard provides a comprehensive checklist f |
 | `commit-message-guide` | Standardized commit messages improve code review e |
+| `container-image-standards` | Container Image Build and Security Standards |
 | `container-security` | 容器安全標準 |
 | `containerization-standards` | Containerization Standards |
 | `context-aware-loading` | This standard defines a protocol for AI tools to s |
 | `contract-testing-standards` | Contract testing verifies that a provider (API ser |
 | `cost-budget-test` | Cost Budget Test Standards |
 | `cross-flow-regression` | This standard defines cross-flow regression testin |
+| `data-contract` | Data Contract Standards |
 | `data-migration-testing` | Data Migration Testing |
+| `data-pipeline` | Data Pipeline Standards |
 | `database-standards` | This standard defines guidelines for database desi |
 | `deployment-standards` | This standard defines guidelines for safely deploy |
 | `deprecation-standards` | Deprecation & Sunset Standards |
@@ -221,22 +228,30 @@
 | `git-worktree` | Define a lifecycle for using Git worktrees to isol |
 | `governance-layer` | A governance layer provides a shared anchor for al |
 | `health-check-standards` | Health Check Standards |
+| `iac-design-principles` | Infrastructure as Code Design Principles |
 | `immutability-first` | Immutability-First Architecture Standard |
+| `incident-response` | Incident Response Standards |
+| `knowledge-graph-memory` | This standard defines a **relationship schema** so |
 | `knowledge-transfer-standards` | Knowledge Transfer Standards |
+| `license-compliance` | License Compliance Standards |
 | `llm-output-validation` | LLM 輸出驗證標準 |
 | `logging-standards` | Logging Standards |
 | `mock-boundary` | This document defines rules for what can and canno |
+| `model-provenance` | Model Provenance Policy Standards |
 | `model-selection` | Define a cost-effective strategy for selecting AI  |
 | `mutation-testing` | Mutation testing evaluates test suite effectivenes |
 | `no-cicd-deployment` | No-CI/CD Deployment Strategy |
 | `observability-standards` | Observability Standards |
 | `packaging-standards` | This standard defines a Recipe-based packaging fra |
 | `performance-standards` | This standard defines comprehensive guidelines for |
+| `pii-classification` | PII Classification and Handling Standards |
 | `pipeline-integration-standards` | Pipeline Integration Standards |
 | `pipeline-security-gates` | Pipeline Security Gates（CI Pipeline 安全檢查點） |
 | `policy-as-code-testing` | Policy as Code 測試標準 |
 | `postmortem-standards` | Postmortem Standards (Blameless Post-Incident Review) |
+| `prd-standards` | Product Requirements Document Standards |
 | `privacy-standards` | Privacy Standards |
+| `product-metrics-standards` | Product Metrics Framework Standards |
 | `project-context-memory` | This standard defines a structured system for capt |
 | `project-structure` | This standard defines conventions for project dire |
 | `prompt-regression` | Prompt Regression Standards |
@@ -247,18 +262,24 @@
 | `release-readiness-gate` | This standard defines a **single, aggregated Relea |
 | `replay-test` | Replay Test Standards |
 | `requirement-engineering` | Requirement Engineering Standards |
+| `resource-cost-boundary` | Resource / Cost Boundary Declaration Standards |
 | `retrospective-standards` | Retrospectives are structured team reflections tha |
 | `retry-standards` | Retry Standards |
 | `reverse-engineering-standards` | This standard defines the principles, workflows, a |
 | `rollback-standards` | Rollback Standards（回滾標準） |
 | `runbook-standards` | Runbook Standards |
+| `runbook` | Runbook Writing Standards |
 | `sast-advanced` | This standard defines Advanced Static Application  |
+| `schema-evolution` | Schema Evolution Standards |
+| `secret-management-standards` | Secret Management and Credential Hygiene Standards |
 | `secure-op` | Secure-Op：AI Agent 安全操作標準 |
 | `security-decision` | Security Decision Standard |
 | `security-standards` | This standard defines comprehensive security guide |
 | `security-testing` | This document defines the security testing methodo |
+| `self-review-protocol` | This standard mandates a **self-review pass** on l |
 | `server-ops-security` | 伺服器操作安全標準 |
 | `skill-standard-alignment-check` | Skill-Standard Alignment Check |
+| `slo-sli` | SLO/SLI Definition Standards |
 | `slo-standards` | SLO Standards (Service Level Objectives) |
 | `smoke-test` | Smoke Test Standards |
 | `spec-driven-development` | Spec-Driven Development (SDD) Standards |
@@ -277,7 +298,9 @@
 | `timeout-standards` | Timeout Standards |
 | `token-budget` | Token Budget Zone Standard |
 | `translation-lifecycle-standards` | Translation lifecycle standards: MISSING vs OUTDAT |
+| `user-story-mapping` | User Story Mapping Standards |
 | `verification-evidence` | Establish an "Iron Law" that no task can be claime |
+| `verification-oracle` | Verification Oracle Standards |
 | `versioning` | This standard defines how to version software rele |
 | `virtual-organization-standards` | This standard treats the AI ecosystem as a "Virtua |
 | `workflow-enforcement` | Workflow Enforcement Standards |
@@ -332,6 +355,7 @@
 | `fix-manifest-paths.ps1` | Fix Manifest Paths |
 | `fix-manifest-paths.sh` | Manifest Path Fixer |
 | `generate-docs.mjs` | Generate Docs |
+| `generate-locale-coverage.mjs` | Locale Coverage Generator |
 | `generate-version-manifest.mjs` | Generate Version Manifest (SPEC-SELFDIAG-001 REQ-9 |
 | `install-hooks.mjs` | Install Hooks |
 | `install-hooks.sh` | DEPRECATED: Use 'node scripts/install-hooks.mjs' i |
@@ -340,6 +364,7 @@
 | `pre-release-check.sh` | Pre-release Check Script |
 | `pre-release.ps1` | Pre-Release Preparation Script for Universal Devel |
 | `pre-release.sh` | Pre-Release Preparation Script |
+| `setup-hooks.sh` | setup-hooks.sh — Install git hooks for UDS repo |
 | `setup-husky.mjs` | Cross-platform Husky Setup Script |
 | `sync-manifest.mjs` | Sync Manifest |
 

package/bundled/locales/zh-CN/docs/FEATURE-REFERENCE.md

@@ -1,23 +1,23 @@
 # UDS 功能参考手册
 
 > Universal Development Standards - 完整功能文档
-> Auto-generated | Last updated: 2026-05-14
+> Auto-generated | Last updated: 2026-06-20
 
-**Language**: [English](../../../docs/FEATURE-REFERENCE.md) | [繁體中文](../../zh-TW/docs/FEATURE-REFERENCE.md) | 简体中文
+**Language**: [English](../../../docs/reference/FEATURE-REFERENCE.md) | [繁體中文](../../zh-TW/docs/FEATURE-REFERENCE.md) | 简体中文
 
 ---
 
 ## 目录
 
 1. [CLI 指令](#cli-commands) (9)
-2. [斜线命令](#slash-commands) (49)
-3. [技能](#skills) (54)
+2. [斜线命令](#slash-commands) (51)
+3. [技能](#skills) (55)
 4. [代理](#agents) (5)
 5. [工作流程](#workflows) (5)
-6. [核心规范](#core-standards) (125)
-7. [脚本](#scripts) (55)
+6. [核心规范](#core-standards) (145)
+7. [脚本](#scripts) (57)
 
-**Total Features: 302**
+**Total Features: 327**
 
 ---
 
@@ -89,6 +89,7 @@
 | `--migrate` | Migrate legacy manifest to hash-based tracking |
 | `--offline` | Skip npm registry check for CLI updates |
 | `--force` | Bypass UDS source-repo self-adoption guard (DEC-044 / XSPEC-071) |
+| `--i18n` | Run i18n lint rules (XSPEC-239) across canonical + locale variants |
 
 ### `uds update`
 
@@ -109,6 +110,7 @@
 | `--plan` | Show reconciliation plan without executing (like terraform plan) |
 | `--force` | Force update all files, ignoring hash comparison |
 | `--rollback` | Rollback to the most recent backup |
+| `--locale` | Override locale for skills install (zh-tw, zh-cn, en); also reads .uds/install.yaml + UDS_LOCALE env |
 
 ### `uds skills`
 
@@ -164,6 +166,7 @@
 | `/check` | [UDS] Verify standards adoption status |
 | `/checkin` | "[UDS] Pre-commit quality gates verification" |
 | `/ci-cd` | "[UDS] Guide CI/CD pipeline design, configuration and optimization" |
+| `/code-review` | [UDS] Perform systematic code review with checklist |
 | `/commit` | [UDS] Generate commit messages following Conventional Commits standard |
 | `/config` | [UDS] Configure project development standards |
 | `/coverage` | [UDS] Analyze test coverage and provide recommendations |
@@ -182,6 +185,7 @@
 | `/guide` | [UDS] Access Universal Development Standards guides and references. |
 | `/incident` | "[UDS] Guide incident response, root cause analysis and post-mortem documentation" |
 | `/init` | [UDS] Initialize development standards in current project |
+| `/journey-test` | [UDS] Generate coherent user journey test plans (TESTPLAN) and E2E skeletons from a project description. |
 | `/methodology` | [UDS] Manage development methodology workflow |
 | `/metrics` | "[UDS] Track development metrics, code quality indicators and project health" |
 | `/migrate` | "[UDS] Guide code migration, framework upgrades and technology modernization" |
@@ -194,12 +198,12 @@
 | `/reverse-sdd` | [UDS] Reverse engineer code into SDD specification document |
 | `/reverse-tdd` | [UDS] Analyze BDD-TDD coverage gaps |
 | `/reverse` | [UDS] Reverse engineer code to Specs, BDD, or TDD coverage. |
-| `/review` | [UDS] Perform systematic code review with checklist |
 | `/runbook` | "[UDS] Guide runbook creation, maintenance, drills, and coverage reporting" |
 | `/scan` | "[UDS] Guide automated security scanning, dependency auditing and secret detection" |
 | `/sdd-retro` | [UDS] Create retroactive specs for untracked feat/fix commits |
 | `/sdd` | [UDS] Create or review specification documents for Spec-Driven Development |
 | `/security` | "[UDS] Guide security review and vulnerability assessment following OWASP standards" |
+| `/skill-builder` | [UDS] Identify repeated processes and build Skills with the right development depth. |
 | `/slo` | "[UDS] Guide SLI selection, SLO setting, and Error Budget management" |
 | `/tdd` | [UDS] Guide through Test-Driven Development workflow |
 | `/update` | [UDS] Update development standards to latest version |
@@ -217,7 +221,7 @@
 | `ai-instruction-standards` | Create and maintain AI instruction files (CLAUDE.md, AGENTS.md, .cursor/rules/, etc.) with proper structure. |
 | `api-design-assistant` | Guide API design following REST, GraphQL, and gRPC best practices. |
 | `atdd-assistant` | "[UDS] Guide through Acceptance Test-Driven Development workflow" |
-| `audit-assistant` | "[UDS] UDS Health & Feedback System \| UDS 健康檢查與回饋系統" |
+| `audit-assistant` | "[UDS] UDS Health & Feedback System" |
 | `bdd-assistant` | "[UDS] Guide through Behavior-Driven Development workflow" |
 | `brainstorm-assistant` | "[UDS] Structured AI-assisted brainstorming before spec creation" |
 | `changelog-guide` | "[UDS] Generate and maintain CHANGELOG.md entries" |
@@ -237,7 +241,8 @@
 | `error-code-guide` | Design consistent error codes following the PREFIX_CATEGORY_NUMBER format. |
 | `git-workflow-guide` | Guide Git branching strategies, branch naming, and merge operations. |
 | `incident-response-assistant` | Guide incident response, root cause analysis, and post-mortem documentation. |
-| `journey-test-assistant` | "[UDS] 從專案描述生成連貫使用者旅程測試計畫（TESTPLAN）與 E2E 骨架" |
+| `journey-test-assistant` | "[UDS] Generate coherent user journey test plans (TESTPLAN) and E2E skeletons from project description." |
+| `knowledge-graph` | "[UDS] Trace spec/decision/code impact chains via a knowledge graph (engine or Markdown fallback)" |
 | `logging-guide` | Implement structured logging with proper log levels and sensitive data handling. |
 | `metrics-dashboard-assistant` | "[UDS] Track development metrics, code quality indicators, and project health" |
 | `migration-assistant` | "[UDS] Guide code migration, framework upgrades, and technology modernization" |
@@ -252,7 +257,7 @@
 | `release-standards` | "[UDS] Guide release process and changelogs" |
 | `requirement-assistant` | "[UDS] Write user stories and requirements following INVEST criteria" |
 | `retrospective-assistant` | [UDS] Guide structured team retrospectives for Sprint and Release cycles. |
-| `reverse-engineer` | "[UDS] System archeology — reverse engineer code across Logic, Data, and Runtime dimensions" |
+| `reverse-engineer` | "[UDS] System archeology - reverse engineer code across Logic, Data, and Runtime dimensions" |
 | `runbook-assistant` | Guide runbook creation, maintenance, and drill exercises. |
 | `security-assistant` | Guide security review and vulnerability assessment following OWASP standards. |
 | `security-scan-assistant` | Guide automated security scanning, dependency auditing, and secret detection. |
@@ -295,9 +300,9 @@
 
 | Standard | 版本 | 说明 |
 |----------|---------|-------------|
-| `acceptance-criteria-traceability` | - |  |
+| `acceptance-criteria-traceability` | 1.1.0 |  |
 | `acceptance-test-driven-development` | 1.1.0 |  |
-| `accessibility-standards` | 1.0.0 | This standard defines comprehensive guidelines for creating accessible software  |
+| `accessibility-standards` | 1.1.0 | This standard defines comprehensive guidelines for creating accessible software  |
 | `adr-standards` | 1.0.0 | Architecture Decision Records capture the context, options, and rationale behind |
 | `adversarial-test` | - |  |
 | `agent-behavior-discipline` | 1.0.0 | This standard defines four behavioral disciplines for AI agents that elevate per |
@@ -306,76 +311,88 @@
 | `ai-agreement-standards` | 1.0.0 | This standard formalizes the interaction between Human (Acquirer) and AI (Suppli |
 | `ai-command-behavior` | 1.0.0 | This standard defines a structure for specifying AI Agent runtime behavior in co |
 | `ai-friendly-architecture` | 1.0.0 | This standard defines architecture and documentation practices that maximize the |
-| `ai-instruction-standards` | 1.0.0 | This standard defines best practices for creating and maintaining AI instruction |
-| `ai-response-navigation` | 1.0.0 | This standard defines navigation behavior for AI responses: every substantive AI |
+| `ai-instruction-standards` | 1.1.0 | This standard defines best practices for creating and maintaining AI instruction |
+| `ai-response-navigation` | 1.1.0 | This standard defines navigation behavior for AI responses: every substantive AI |
 | `alerting-standards` | 1.0.0 |  |
 | `anti-hallucination` | 1.5.1 | This standard defines strict guidelines for AI assistants to prevent hallucinati |
 | `anti-sycophancy-prompting` | 1.0.0 | This standard defines techniques and rules for designing prompts that elicit gen |
 | `api-design-standards` | 1.0.0 | This standard defines comprehensive guidelines for designing, building, and main |
+| `audit-trail` | 1.0.0 | **Status**: Active | **Updated**: 2026-06-17 |  |
 | `behavior-driven-development` | 1.1.0 |  |
 | `behavior-snapshot` | - |  |
 | `branch-completion` | 1.0.0 | Define a standardized workflow for completing development branches, including pr |
-| `browser-compatibility-standards` | 1.0.0 | This standard defines supported browser and device matrices, testing automation  |
+| `browser-compatibility-standards` | 1.0.2 | This standard defines supported browser and device matrices, testing automation  |
 | `capability-declaration` | - |  |
 | `cd-deployment-strategies` | - |  |
 | `change-batching-standards` | - |  |
 | `changelog-standards` | 1.0.2 | This standard defines how to write and maintain a CHANGELOG.md file to communica |
 | `chaos-engineering-standards` | 1.0.0 |  |
 | `chaos-injection-tests` | - |  |
-| `checkin-standards` | 1.6.0 | This standard defines quality gates that MUST be passed before committing code t |
+| `checkin-standards` | 1.7.0 | This standard defines quality gates that MUST be passed before committing code t |
 | `circuit-breaker` | - |  |
-| `code-review-checklist` | 1.3.0 | This standard provides a comprehensive checklist for reviewing code changes, ens |
+| `code-review-checklist` | 1.4.0 | This standard provides a comprehensive checklist for reviewing code changes, ens |
 | `commit-message-guide` | 1.3.0 | Standardized commit messages improve code review efficiency, facilitate automate |
+| `container-image-standards` | 1.0.0 | **Status**: Active | **Updated**: 2026-06-17 |  |
 | `container-security` | - |  |
 | `containerization-standards` | 1.0.0 |  |
 | `context-aware-loading` | 1.0.0 | This standard defines a protocol for AI tools to selectively load development st |
 | `contract-testing-standards` | 1.0.0 | Contract testing verifies that a provider (API server) and its consumers (client |
 | `cost-budget-test` | - |  |
-| `cross-flow-regression` | 1.0.0 | This standard defines cross-flow regression testing — verifying that changes to  |
+| `cross-flow-regression` | 1.0.1 | This standard defines cross-flow regression testing — verifying that changes to  |
+| `data-contract` | 1.0.0 | **Status**: Active | **Updated**: 2026-06-17 |  |
 | `data-migration-testing` | - |  |
+| `data-pipeline` | 1.0.0 | **Status**: Active | **Updated**: 2026-06-17 |  |
 | `database-standards` | 1.0.0 | This standard defines guidelines for database design, querying, migration, and o |
-| `deployment-standards` | 1.0.0 | This standard defines guidelines for safely deploying software to production, co |
+| `deployment-standards` | 1.1.0 | This standard defines guidelines for safely deploying software to production, co |
 | `deprecation-standards` | 1.0.0 |  |
 | `design-document-standards` | 1.0.0 |  |
-| `developer-memory` | 1.0.0 | This standard defines a structured system for capturing, retrieving, and surfaci |
+| `developer-memory` | 1.1.1 | This standard defines a structured system for capturing, retrieving, and surfaci |
 | `disaster-recovery-drill` | - |  |
 | `documentation-lifecycle` | 1.0.0 | This standard defines **when** to update documentation, **when** to check it, an |
 | `documentation-structure` | 1.5.0 | This standard defines a consistent documentation structure for software projects |
 | `documentation-writing-standards` | 1.2.0 | This standard defines documentation requirements based on project types and prov |
 | `dual-phase-output` | - |  |
 | `environment-standards` | 1.0.0 |  |
-| `error-code-standards` | 1.2.0 |  |
+| `error-code-standards` | 1.2.1 |  |
 | `estimation-standards` | 1.0.0 |  |
 | `execution-history` | 1.0.0 |  |
 | `failure-source-taxonomy` | - |  |
 | `feature-flag-standards` | 1.0.0 |  |
 | `feature-manifest-standard` | - |  |
 | `flaky-test-management` | - |  |
-| `flow-based-testing` | 1.3.0 | This document defines a systematic methodology for testing multi-step processes. |
-| `forward-derivation-standards` | 1.2.0 | This standard defines the principles and workflows for Forward Derivation—automa |
+| `flow-based-testing` | 1.3.1 | This document defines a systematic methodology for testing multi-step processes. |
+| `forward-derivation-standards` | 1.3.0 | This standard defines the principles and workflows for Forward Derivation—automa |
 | `frontend-design-standards` | 1.0.0 | This standard defines a machine-readable frontend design specification format (D |
 | `full-coverage-testing` | - |  |
 | `git-workflow` | 1.4.0 | This standard defines Git branching strategies and workflows to ensure consisten |
-| `git-worktree` | 1.0.0 | Define a lifecycle for using Git worktrees to isolate development work, ensuring |
+| `git-worktree` | 1.1.0 | Define a lifecycle for using Git worktrees to isolate development work, ensuring |
 | `governance-layer` | 1.0.0 | A governance layer provides a shared anchor for all agents and roles in a projec |
 | `health-check-standards` | - |  |
+| `iac-design-principles` | 1.0.0 | **Status**: Active | **Updated**: 2026-06-17 |  |
 | `immutability-first` | - |  |
+| `incident-response` | 1.0.0 | **Status**: Active | **Updated**: 2026-06-17 |  |
+| `knowledge-graph-memory` | 1.0.0 | This standard defines a **relationship schema** so that specifications, decision |
 | `knowledge-transfer-standards` | 1.0.0 |  |
+| `license-compliance` | 2.1.0 | **Status**: Active | **Updated**: 2026-05-16 |  |
 | `llm-output-validation` | - |  |
-| `logging-standards` | 1.2.0 |  |
+| `logging-standards` | 1.4.0 |  |
 | `mock-boundary` | 1.0.0 | This document defines rules for what can and cannot be mocked in tests. Its goal |
-| `model-selection` | 1.0.0 | Define a cost-effective strategy for selecting AI model tiers based on task comp |
+| `model-provenance` | 1.0.0 | **Status**: Active | **Updated**: 2026-06-17 |  |
+| `model-selection` | 1.0.1 | Define a cost-effective strategy for selecting AI model tiers based on task comp |
 | `mutation-testing` | 1.0.0 | Mutation testing evaluates test suite effectiveness by injecting artificial bugs |
 | `no-cicd-deployment` | - |  |
 | `observability-standards` | 1.0.0 |  |
-| `packaging-standards` | 1.0.0 | This standard defines a Recipe-based packaging framework that enables user proje |
-| `performance-standards` | 1.1.0 | This standard defines comprehensive guidelines for software performance engineer |
+| `packaging-standards` | 1.1.0 | This standard defines a Recipe-based packaging framework that enables user proje |
+| `performance-standards` | 1.2.0 | This standard defines comprehensive guidelines for software performance engineer |
+| `pii-classification` | 1.1.0 | **Status**: Active | **Updated**: 2026-06-19 |  |
 | `pipeline-integration-standards` | - |  |
 | `pipeline-security-gates` | - |  |
 | `policy-as-code-testing` | - |  |
 | `postmortem-standards` | 1.0.0 |  |
-| `privacy-standards` | 1.0.0 |  |
-| `project-context-memory` | 1.1.0 | This standard defines a structured system for capturing, retrieving, and enforci |
+| `prd-standards` | 1.0.0 | **Status**: Active | **Updated**: 2026-06-17 |  |
+| `privacy-standards` | 1.1.0 |  |
+| `product-metrics-standards` | 1.0.0 | **Status**: Active | **Updated**: 2026-06-17 |  |
+| `project-context-memory` | 1.2.0 | This standard defines a structured system for capturing, retrieving, and enforci |
 | `project-structure` | 1.2.0 | This standard defines conventions for project directory structure beyond documen |
 | `prompt-regression` | - |  |
 | `property-based-testing` | - |  |
@@ -385,21 +402,27 @@
 | `release-readiness-gate` | 1.0.0 | This standard defines a **single, aggregated Release Readiness Gate** that unifi |
 | `replay-test` | - |  |
 | `requirement-engineering` | 1.0.0 |  |
+| `resource-cost-boundary` | 1.0.0 | **Status**: Active | **Updated**: 2026-06-17 |  |
 | `retrospective-standards` | 1.0.0 | Retrospectives are structured team reflections that identify what worked well, w |
 | `retry-standards` | - |  |
-| `reverse-engineering-standards` | 1.0.0 | This standard defines the principles, workflows, and best practices for reverse  |
+| `reverse-engineering-standards` | 1.1.0 | This standard defines the principles, workflows, and best practices for reverse  |
 | `rollback-standards` | - |  |
 | `runbook-standards` | 1.0.0 |  |
+| `runbook` | 1.0.0 | **Status**: Active | **Updated**: 2026-06-17 |  |
 | `sast-advanced` | 1.0.0 | This standard defines Advanced Static Application Security Testing (SAST) practi |
+| `schema-evolution` | 1.0.0 | **Status**: Active | **Updated**: 2026-06-17 |  |
+| `secret-management-standards` | 1.0.0 | **Status**: Active | **Updated**: 2026-06-17 |  |
 | `secure-op` | - |  |
 | `security-decision` | - |  |
 | `security-standards` | 1.1.0 | This standard defines comprehensive security guidelines for software development |
-| `security-testing` | 1.0.0 | This document defines the security testing methodology for software projects. It |
+| `security-testing` | 1.1.0 | This document defines the security testing methodology for software projects. It |
+| `self-review-protocol` | 1.0.0 | This standard mandates a **self-review pass** on large markdown edits before com |
 | `server-ops-security` | - |  |
 | `skill-standard-alignment-check` | - |  |
+| `slo-sli` | 1.0.0 | **Status**: Active | **Updated**: 2026-06-17 |  |
 | `slo-standards` | 1.0.0 |  |
 | `smoke-test` | - |  |
-| `spec-driven-development` | 2.2.0 |  |
+| `spec-driven-development` | 2.3.0 |  |
 | `standard-admission-criteria` | - |  |
 | `standard-lifecycle-management` | - |  |
 | `structured-task-definition` | 1.0.0 |  |
@@ -415,7 +438,9 @@
 | `timeout-standards` | - |  |
 | `token-budget` | - |  |
 | `translation-lifecycle-standards` | 1.0.0 | Translation lifecycle standards: MISSING vs OUTDATED distinction, semver-aware s |
+| `user-story-mapping` | 1.0.0 | **Status**: Active | **Updated**: 2026-06-17 |  |
 | `verification-evidence` | 1.0.0 | Establish an "Iron Law" that no task can be claimed as complete without verifica |
+| `verification-oracle` | 1.0.0 | **Status**: Active | **Updated**: 2026-06-17 |  |
 | `versioning` | 1.2.0 | This standard defines how to version software releases using Semantic Versioning |
 | `virtual-organization-standards` | 1.0.0 | This standard treats the AI ecosystem as a "Virtual Organization." It defines ho |
 | `workflow-enforcement` | - |  |
@@ -472,6 +497,7 @@
 | `fix-manifest-paths.ps1` | Fix Manifest Paths |
 | `fix-manifest-paths.sh` | Manifest Path Fixer |
 | `generate-docs.mjs` | Generate Docs |
+| `generate-locale-coverage.mjs` | Locale Coverage Generator |
 | `generate-version-manifest.mjs` | Generate Version Manifest (SPEC-SELFDIAG-001 REQ-9, AC-14) |
 | `install-hooks.mjs` | Install Hooks |
 | `install-hooks.sh` | DEPRECATED: Use 'node scripts/install-hooks.mjs' instead (cross-platform). |
@@ -480,6 +506,7 @@
 | `pre-release-check.sh` | Pre-release Check Script |
 | `pre-release.ps1` | Pre-Release Preparation Script for Universal Development Standards |
 | `pre-release.sh` | Pre-Release Preparation Script |
+| `setup-hooks.sh` | setup-hooks.sh — Install git hooks for UDS repo |
 | `setup-husky.mjs` | Cross-platform Husky Setup Script |
 | `sync-manifest.mjs` | Sync Manifest |