universal-dev-standards 5.17.0 → 6.1.0

package/bundled/core/versioning.md

@@ -2,8 +2,8 @@
 
 > **Language**: English | [繁體中文](../locales/zh-TW/core/versioning.md)
 
-**Version**: 1.2.0
-**Last Updated**: 2025-12-30
+**Version**: 1.5.0
+**Last Updated**: 2026-07-01
 **Applicability**: All software projects with versioned releases
 **Scope**: universal
 **Industry Standards**: Semantic Versioning 2.0.0
@@ -156,6 +156,94 @@ Format: `MAJOR.MINOR.PATCH+BUILD`
 - Use for CI/CD tracking
 - Include in artifacts but not in version comparison
 
+> **Critical: build metadata MUST NOT be used as a deployment discriminator.**
+> Because tooling ignores `+build` in precedence and comparison (above), two builds
+> differing only in build metadata (`1.2.3+abc` vs `1.2.3+def`) are **indistinguishable
+> to version-comparison tooling** — rollback targets and `semver` comparison treat them
+> as the same release. Using `+sha` to tell apart behaviorally-different deployed builds
+> is a governance bypass: the version stops being the join key for changelog / SBOM /
+> audit / rollback / SLA / CVE scope. A change that ships MUST get a real version bump or
+> a unique immutable artifact identity (see **Deployment Version Identity** below) —
+> `+sha` is **not** a substitute.
+
+---
+
+## Deployment Version Identity
+
+> Source: a recurring failure mode — multiple behaviorally-different hotfix builds
+> deployed under the same `X.Y.Z`, distinguishable only by `+sha`, so answering
+> "which build is in prod / is fix X actually deployed?" collapses into commit
+> archaeology.
+
+This section governs the identity of a **deployable unit** — whatever that unit is for the
+project (a container image, a tarball, a published package). It complements the
+[Release Process](#release-process) below, which describes one concrete single-host release
+flow; the identity rules here apply regardless of the deployment mechanism.
+
+### Core invariant
+
+**Every distinct deployable build artifact MUST carry a unique, immutable version
+identity (version proper + commit sha).** Deploying, *promoting*, or *rolling back*
+an **existing** artifact MUST NOT change its identity.
+
+- **Anchor on the artifact, not the deploy action.** A new build (different source or
+  dependencies) ⇒ new version. The *same* build moved between environments
+  (staging → prod, build-once-deploy-many), redeployed (blue-green / canary), or
+  rolled back is the **same** artifact and keeps its identity — it MUST NOT be
+  re-bumped. Re-bumping on promote/rollback makes the version number lie about what
+  is actually running. (When a rollback restores a previous artifact, it restores that
+  artifact's original identity — it does not mint a new one.)
+- **Never deploy two distinct builds under the same `X.Y.Z`.**
+
+### Enforce automatically, not by discipline
+
+The invariant SHOULD be enforced by an automatic mechanism rather than human discipline
+alone — the failure mode above *is* a forgotten manual bump. Any of these satisfies it:
+
+- **Commit-driven release automation** (`semantic-release` / `standard-version`, see
+  [Automation Tools](#automation-tools)): derives and bumps the version from commit
+  history in CI, so a human cannot forget to bump.
+- **Git-height–derived versioning** (MinVer / Nerdbank.GitVersioning / GitVersion):
+  the version is derived from git commit topology, so a collision is structurally
+  impossible. RECOMMENDED for polyglot / .NET / JVM projects (the Automation Tools
+  section is otherwise Node-centric) — see the git-height subsection under
+  [Automation Tools](#automation-tools). Note caveats for monorepos and squash-merge
+  workflows.
+- **A CI uniqueness gate**: fail the release if the computed version already exists
+  as a git tag or in the registry.
+
+### Immutable artifacts (cross-reference)
+
+A unique *number* is necessary but not sufficient — the *artifact* must also be immutable
+and content-addressed (e.g. a container image referenced by digest rather than a mutable
+tag). The concrete artifact-level requirements — pinning deployments to a content address
+and forbidding tag/version reuse — **belong with container-image-standards** and are to be
+specified there; this standard only requires that the version identity itself remain
+unique and immutable.
+
+### Build identity is observable (requirement)
+
+**A deployed service MUST expose its build identity — `version + commit sha + build time` —
+through a queryable endpoint** (a dedicated `/version`, or embedded in `/health`), so
+operators can determine exactly what is running without inspecting the binary or resorting to
+commit archaeology. Rationale: manual version numbers can collide (above), so ops needs the
+`sha` to tell apart two builds that ship under the same `X.Y.Z`.
+
+Requirements:
+
+- The exposed `sha` MUST match the deployed artifact's sha — it is **verifiable, not
+  self-reported** (derive it from the build, do not hand-type it).
+- The endpoint SHOULD be access-controlled; a public build-identity endpoint leaks internal
+  commit identity.
+- Post-release verification MUST assert the returned sha equals the deployed artifact's sha
+  (see [Phase 5: Post-release Verification](#phase-5-post-release-verification)), not merely
+  that the version number is correct.
+
+This is a deployment / observability concern: the concrete verification *mechanism* (how the
+endpoint is scraped and the assertion wired into a gate) **belongs with deployment-standards**
+(to be specified there), and **supply-chain-attestation** already provides provenance as
+the cryptographic backing for "this artifact came from this sha".
+
 ---
 
 ## Initial Development
@@ -431,8 +519,10 @@ sudo ./upgrade.sh
 # 1. Check service status
 systemctl status your-service
 
-# 2. Check application version
-curl http://localhost:PORT/api/version
+# 2. Check application build identity (version + commit sha + build time)
+#    Assert the returned sha matches the deployed artifact's sha — not just the version.
+curl http://localhost:PORT/version    # or /health, if build identity is embedded there
+# Expected: {"version": "1.2.1", "sha": "<deployed-artifact-sha>", "buildTime": "..."}
 
 # 3. Check logs for no errors
 tail -100 /path/to/app.log | grep -i error
@@ -440,7 +530,9 @@ tail -100 /path/to/app.log | grep -i error
 
 **Success Criteria**:
 - Service running normally
-- API returns correct version number
+- `/version` (or `/health`) returns the correct version number **and** a commit sha that
+  matches the deployed artifact — a matching version alone is insufficient, since two builds
+  can share one `X.Y.Z` (see [Build identity is observable](#build-identity-is-observable-requirement))
 - No fatal errors in logs
 - Functionality verification passed
 
@@ -595,6 +687,32 @@ npm install --save-dev semantic-release
 }
 ```
 
+### Git-height–derived versioning (polyglot: .NET / JVM / multi-language)
+
+The tools above are Node/npm-centric. For **.NET, JVM, or multi-language projects**, prefer
+**git-height–derived versioning**, where the version is computed automatically from the git
+tag graph plus the number of commits since the last tag ("commit height") rather than stored
+in a hand-edited file. Because the version is a deterministic function of git history,
+**two different builds cannot collide on the same version number** and no manual bump step
+can be forgotten — this is what makes it satisfy
+[Deployment Version Identity](#deployment-version-identity) structurally rather than by
+discipline.
+
+| Tool | Ecosystem | Notes |
+|------|-----------|-------|
+| **MinVer** | .NET / MSBuild | Derives the version from the nearest git tag plus commit height; no config file, no build server integration required |
+| **Nerdbank.GitVersioning** (nbgv) | .NET (also Node and others) | Reads a `version.json`; stamps version + git height + commit id into assemblies and packages |
+| **GitVersion** | Polyglot (.NET, plus a language-agnostic CLI) | Configurable versioning modes (e.g. Mainline, Continuous Delivery / Continuous Deployment) driven by branch and tag topology |
+
+**When to use which:**
+
+- **Node / npm projects** → commit-driven automation (`semantic-release` / `standard-version`, above): the bump is derived from Conventional Commits.
+- **Polyglot / .NET / JVM projects** → git-height–derived tools (MinVer / Nerdbank.GitVersioning / GitVersion): the version is derived from git tag + commit height.
+
+Both families remove the forgettable manual bump. **Caveats:** in a monorepo a single
+repo-wide commit height may not map cleanly onto per-package versions, and squash-merge
+workflows alter commit height — validate the derived version against your tagging convention.
+
 ---
 
 ## Dependency Version Ranges
@@ -638,113 +756,14 @@ npm install --save-dev semantic-release
 
 ---
 
-## Breaking Change Communication
-
-### 1. Deprecation Warnings (N-1 Version)
-
-```javascript
-// Version 1.5.0 - Add deprecation warning
-/**
- * @deprecated Use authenticateV2() instead. Will be removed in v2.0.0
- */
-function authenticate(username, password) {
-  console.warn('[DEPRECATED] authenticate() will be removed in v2.0.0. Use authenticateV2()');
-  return authenticateV2(username, password);
-}
-```
-
-### 2. API Versioning Strategies
-
-Choose an API versioning strategy based on your needs:
-
-| Strategy | Format | Pros | Cons |
-|----------|--------|------|------|
-| URL Path | `/api/v1/users` | Clear, easy routing | URL pollution |
-| Query Parameter | `/api/users?version=1` | Optional versioning | Cache issues |
-| Header | `Accept: application/vnd.api.v1+json` | Clean URLs | Less visible |
-| Content Negotiation | `Accept: application/vnd.api+json;version=1` | RESTful | Complex |
+## Breaking Changes & Deprecation
 
-**Recommended**: URL Path versioning for most APIs (clearest for developers).
+Breaking changes drive the **MAJOR** version increment (see [Incrementing Rules](#incrementing-rules)) — that is how SemVer signals an incompatible change to consumers. The *contract-level* details of evolving and retiring an API are owned by the standards responsible for those concerns, so each rule has a single source of truth:
 
-### 3. Deprecation Timeline
+- **API versioning strategies, the backward-compatibility checklist (what counts as a breaking change), deprecation annotations in code, and the migration-guide template** → [API Design Standards](api-design-standards.md#api-versioning-strategies)
+- **The deprecation lifecycle, minimum notice periods by API tier, `Sunset` / `Deprecation` headers, and consumer notification** → [Deprecation & Sunset Standards](deprecation-standards.md#api-deprecation)
 
-Follow this timeline when deprecating API features:
-
-```
-v1.0.0 - Feature introduced
-v1.5.0 - Deprecation warning added (minimum N-1 version)
-v2.0.0 - Feature removed (document in migration guide)
-```
-
-**Deprecation Period Guidelines**:
-
-| API Type | Minimum Deprecation Period |
-|----------|---------------------------|
-| Internal API | 1 minor version |
-| Partner API | 2 minor versions + 3 months |
-| Public API | 2 minor versions + 6 months |
-| Critical Infrastructure | 1 year minimum |
-
-### 4. Backward Compatibility Checklist
-
-Before releasing, verify these backward compatibility rules:
-
-**DO NOT break (without major version bump)**:
-- [ ] Remove public API endpoints
-- [ ] Remove required request fields
-- [ ] Add required request fields
-- [ ] Change response field types
-- [ ] Change error code meanings
-- [ ] Remove response fields consumers depend on
-
-**Safe changes (minor/patch version)**:
-- [ ] Add optional request fields
-- [ ] Add new response fields
-- [ ] Add new endpoints
-- [ ] Add new error codes
-- [ ] Improve error messages
-- [ ] Performance improvements
-
-### 5. Migration Guide (N Version)
-
-```markdown
-# Migration Guide: v1.x to v2.0
-
-## Breaking Changes
-
-### 1. authenticate() removed
-
-**Before (v1.x)**:
-```javascript
-const token = await authenticate('user', 'pass');
-```
-
-**After (v2.0)**:
-```javascript
-const token = await authenticateV2({ username: 'user', password: 'pass' });
-```
-
-### 2. API response format changed
-
-**Before (v1.x)**:
-```json
-{ "data": { "user": {...} } }
-```
-
-**After (v2.0)**:
-```json
-{ "user": {...} }
-```
-
-Update your code:
-```javascript
-// Before
-const user = response.data.user;
-
-// After
-const user = response.user;
-```
-```
+This standard keeps only the version-numbering rule: an incompatible change MUST ship as a MAJOR bump, and deprecation SHOULD be announced in a prior MINOR before the removing MAJOR (see [MAJOR Version](#major-version-x00) guidelines).
 
 ---
 
@@ -834,6 +853,8 @@ semver.major('2.3.1');  // 2
 - [Changelog Standards](changelog-standards.md)
 - [Git Workflow Standards](git-workflow.md)
 - [Commit Message Guide](commit-message-guide.md)
+- [API Design Standards](api-design-standards.md) — API versioning strategies, backward-compatibility rules, migration guides
+- [Deprecation & Sunset Standards](deprecation-standards.md) — deprecation lifecycle and minimum notice periods
 
 ---
 
@@ -841,6 +862,9 @@ semver.major('2.3.1');  // 2
 
 | Version | Date | Changes |
 |---------|------|---------|
+| 1.5.0 | 2026-07-01 | Added: git-height–derived versioning tools (MinVer / Nerdbank.GitVersioning / GitVersion) for polyglot / .NET / JVM projects in Automation Tools (UDS #138 R2); elevated "Build identity is observable" to a requirement — deployed services MUST expose `version + commit sha + build time` via a queryable endpoint — and added a commit-sha + build-time assertion to Phase 5 Post-release Verification (UDS #138 R3) |
+| 1.4.0 | 2026-06-24 | Moved out (to single sources): API Versioning Strategies (de-duplicated), Deprecation Timeline + per-tier periods, Backward Compatibility Checklist, and the Migration Guide template — now owned by api-design-standards / deprecation-standards; versioning cross-references them (XSPEC-298 R8, UDS #126) |
+| 1.3.0 | 2026-06-23 | Added: Deployment Version Identity section; build-metadata-as-deployment-discriminator caveat (from UDS #138) |
 | 1.2.0 | 2025-12-30 | Added: API Versioning Strategies, Deprecation Timeline, Backward Compatibility Checklist |
 | 1.1.3 | 2025-12-24 | Added: Related Standards section |
 | 1.1.2 | 2025-12-11 | Improved: Upgrade package naming example to use generic placeholders instead of hardcoded project names |

package/bundled/locales/COVERAGE.md

@@ -1,15 +1,15 @@
 # UDS Locale Coverage
 
-> Auto-generated by `scripts/generate-locale-coverage.mjs` on 2026-05-28.
+> Auto-generated by `scripts/generate-locale-coverage.mjs` on 2026-07-16.
 > Do not edit manually — re-run the script.
 
-> **Canonical**: `skills/` (54) + `core/` (127). **Locales tracked**: `zh-CN`, `zh-TW`.
+> **Canonical**: `skills/` (55) + `core/` (149). **Locales tracked**: `zh-CN`, `zh-TW`.
 
-## Skills (54 canonical)
+## Skills (55 canonical)
 
 | Skill | zh-CN | zh-TW |
 | :-- | :-: | :-: |
-| ac-coverage | :x: | :white_check_mark: 1.0.0 |
+| ac-coverage | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | adr-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | ai-collaboration-standards | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
 | ai-friendly-architecture | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
@@ -18,7 +18,7 @@
 | atdd-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | audit-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | bdd-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| brainstorm-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| brainstorm-assistant | :white_check_mark: 4.1.0 | :white_check_mark: 4.1.0 |
 | changelog-guide | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | checkin-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | ci-cd-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
@@ -26,8 +26,8 @@
 | commit-standards | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | contract-test-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | database-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| deploy-assistant | :x: | :white_check_mark: 1.0.0 |
-| dev-methodology | :x: | :white_check_mark: 1.0.0 |
+| deploy-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| dev-methodology | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | dev-workflow-guide | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | docs-generator | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | documentation-guide | :white_check_mark: 2.1.0 | :white_check_mark: 2.1.0 |
@@ -36,17 +36,18 @@
 | error-code-guide | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | git-workflow-guide | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | incident-response-assistant | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
-| journey-test-assistant | :x: | :white_check_mark: 1.0.0 |
-| logging-guide | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| journey-test-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| knowledge-graph | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| logging-guide | :white_check_mark: 1.4.0 | :white_check_mark: 1.4.0 |
 | metrics-dashboard-assistant | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
 | migration-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | observability-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| orchestrate | :x: | :warning: 1.0.0 (major) |
-| plan | :x: | :warning: 1.0.0 (major) |
+| orchestrate | :white_check_mark: 2.0.0 | :white_check_mark: 2.0.0 |
+| plan | :white_check_mark: 2.0.0 | :white_check_mark: 2.0.0 |
 | pr-automation-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | project-discovery | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
 | project-structure-guide | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
-| push | :x: | :warning: 1.0.0 (major) |
+| push | :white_check_mark: 2.0.0 | :white_check_mark: 2.0.0 |
 | refactoring-assistant | :white_check_mark: 2.0.0 | :white_check_mark: 2.0.0 |
 | release-standards | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
 | requirement-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
@@ -55,19 +56,19 @@
 | runbook-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | security-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | security-scan-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| skill-builder | :x: | :white_check_mark: 1.0.0 |
+| skill-builder | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | slo-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| spec-derivation | :x: | :white_check_mark: 1.0.0 |
+| spec-derivation | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | spec-driven-dev | :white_check_mark: 1.2.0 | :white_check_mark: 1.2.0 |
-| sweep | :x: | :white_check_mark: 1.0.0 |
+| sweep | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | tdd-assistant | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | test-coverage-assistant | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
 | testing-guide | :white_check_mark: 1.2.0 | :white_check_mark: 1.2.0 |
 
-**zh-CN skills coverage**: 44/54 (81%)
-**zh-TW skills coverage**: 54/54 (100%)
+**zh-CN skills coverage**: 55/55 (100%)
+**zh-TW skills coverage**: 55/55 (100%)
 
-## Standards (`core/` — 127 canonical)
+## Standards (`core/` — 149 canonical)
 
 | Standard | zh-CN | zh-TW |
 | :-- | :-: | :-: |
@@ -75,46 +76,50 @@
 | acceptance-test-driven-development.md | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
 | accessibility-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | adr-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| adversarial-test.md | :x: | :x: |
-| agent-behavior-discipline.md | :x: | :x: |
+| adversarial-test.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| agent-behavior-discipline.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | agent-communication-protocol.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | agent-dispatch.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | ai-agreement-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | ai-command-behavior.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | ai-friendly-architecture.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | ai-instruction-standards.md | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
-| ai-response-navigation.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| ai-response-navigation.md | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
 | alerting-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | anti-hallucination.md | :white_check_mark: 1.5.1 | :white_check_mark: 1.5.1 |
 | anti-sycophancy-prompting.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| api-design-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| api-design-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.1.0 |
+| audit-trail.md | :x: | :white_check_mark: 1.0.0 |
 | behavior-driven-development.md | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
-| behavior-snapshot.md | :x: | :x: |
+| behavior-snapshot.md | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
 | branch-completion.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| browser-compatibility-standards.md | :x: | :warning: 0.0.0 (major) |
+| browser-compatibility-standards.md | :white_check_mark: 1.0.2 | :white_check_mark: 1.0.0 |
 | capability-declaration.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| cd-deployment-strategies.md | :x: | :x: |
+| cd-deployment-strategies.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | change-batching-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | changelog-standards.md | :white_check_mark: 1.0.2 | :white_check_mark: 1.0.2 |
 | chaos-engineering-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| chaos-injection-tests.md | :x: | :x: |
+| chaos-injection-tests.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | checkin-standards.md | :white_check_mark: 1.6.0 | :white_check_mark: 1.6.0 |
 | circuit-breaker.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | code-review-checklist.md | :white_check_mark: 1.3.0 | :white_check_mark: 1.3.0 |
 | commit-message-guide.md | :white_check_mark: 1.3.0 | :white_check_mark: 1.3.0 |
-| container-security.md | :x: | :x: |
+| container-image-standards.md | :x: | :white_check_mark: 1.0.0 |
+| container-security.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | containerization-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | context-aware-loading.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| contract-testing-standards.md | :x: | :warning: 0.0.0 (major) |
-| cost-budget-test.md | :x: | :x: |
-| cross-flow-regression.md | :x: | :warning: 0.0.0 (major) |
-| data-migration-testing.md | :x: | :x: |
+| contract-testing-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| cost-budget-test.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| cross-flow-regression.md | :white_check_mark: 1.0.1 | :white_check_mark: 1.0.0 |
+| data-contract.md | :x: | :white_check_mark: 1.0.0 |
+| data-migration-testing.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| data-pipeline.md | :x: | :white_check_mark: 1.0.0 |
 | database-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| deployment-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| deprecation-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| deployment-standards.md | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
+| deprecation-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.1.0 |
 | design-document-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | developer-memory.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| disaster-recovery-drill.md | :x: | :x: |
+| disaster-recovery-drill.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | documentation-lifecycle.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | documentation-structure.md | :white_check_mark: 1.5.0 | :white_check_mark: 1.5.0 |
 | documentation-writing-standards.md | :white_check_mark: 1.2.0 | :white_check_mark: 1.2.0 |
@@ -124,64 +129,79 @@
 | estimation-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | execution-history.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | failure-source-taxonomy.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| feature-discovery-standards.md | :x: | :x: |
 | feature-flag-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| feature-manifest-standard.md | :x: | :x: |
-| flaky-test-management.md | :x: | :x: |
-| flow-based-testing.md | :x: | :x: |
+| feature-manifest-standard.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| flaky-test-management.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| flow-based-testing.md | :white_check_mark: 1.3.1 | :white_check_mark: 1.3.1 |
 | forward-derivation-standards.md | :white_check_mark: 1.2.0 | :white_check_mark: 1.2.0 |
 | frontend-design-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| full-coverage-testing.md | :x: | :x: |
+| full-coverage-testing.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.1.0 |
 | git-workflow.md | :white_check_mark: 1.4.0 | :white_check_mark: 1.4.0 |
 | git-worktree.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| governance-layer.md | :x: | :white_check_mark: 1.0.0 |
+| governance-layer.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | health-check-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| iac-design-principles.md | :x: | :white_check_mark: 1.0.0 |
 | immutability-first.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| incident-response.md | :x: | :white_check_mark: 1.0.0 |
+| knowledge-graph-memory.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | knowledge-transfer-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| license-compliance.md | :x: | :x: |
-| llm-output-validation.md | :x: | :x: |
-| logging-standards.md | :white_check_mark: 1.2.0 | :white_check_mark: 1.2.0 |
-| mock-boundary.md | :x: | :x: |
-| model-selection.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| mutation-testing.md | :x: | :x: |
-| no-cicd-deployment.md | :x: | :x: |
+| license-compliance.md | :white_check_mark: 2.1.0 | :white_check_mark: 2.1.0 |
+| llm-output-validation.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| logging-standards.md | :white_check_mark: 1.4.0 | :white_check_mark: 1.4.0 |
+| mock-boundary.md | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
+| model-provenance.md | :x: | :white_check_mark: 1.0.0 |
+| model-selection.md | :white_check_mark: 1.0.1 | :white_check_mark: 1.0.1 |
+| multi-environment-e2e-testing.md | :x: | :x: |
+| mutation-testing.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| no-cicd-deployment.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | observability-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| packaging-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| performance-standards.md | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
+| packaging-standards.md | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
+| performance-standards.md | :white_check_mark: 1.1.0 | :white_check_mark: 1.2.0 |
+| pii-classification.md | :x: | :white_check_mark: 1.0.0 |
 | pipeline-integration-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| pipeline-security-gates.md | :x: | :x: |
-| policy-as-code-testing.md | :x: | :x: |
+| pipeline-security-gates.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| policy-as-code-testing.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | postmortem-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| prd-standards.md | :x: | :white_check_mark: 1.0.0 |
 | privacy-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| product-metrics-standards.md | :x: | :white_check_mark: 1.0.0 |
 | project-context-memory.md | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
 | project-structure.md | :white_check_mark: 1.2.0 | :white_check_mark: 1.2.0 |
-| prompt-regression.md | :x: | :x: |
-| property-based-testing.md | :x: | :x: |
+| prompt-regression.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| property-based-testing.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| push-standards.md | :x: | :x: |
 | recovery-recipe-registry.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| refactoring-standards.md | :white_check_mark: 2.1.0 | :white_check_mark: 2.1.0 |
-| release-quality-manifest.md | :x: | :x: |
-| release-readiness-gate.md | :x: | :warning: 0.0.0 (major) |
-| replay-test.md | :x: | :x: |
+| refactoring-standards.md | :white_check_mark: 2.1.0 | :white_check_mark: 2.2.0 |
+| release-quality-manifest.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| release-readiness-gate.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| replay-test.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | requirement-engineering.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| resource-cost-boundary.md | :x: | :white_check_mark: 1.0.0 |
 | retrospective-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | retry-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| reverse-engineering-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| rollback-standards.md | :x: | :x: |
+| reverse-engineering-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.2.0 |
+| rollback-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | runbook-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| sast-advanced.md | :x: | :x: |
-| secure-op.md | :x: | :x: |
+| runbook.md | :x: | :white_check_mark: 1.0.0 |
+| sast-advanced.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| schema-evolution.md | :x: | :white_check_mark: 1.0.0 |
+| secret-management-standards.md | :x: | :white_check_mark: 1.0.0 |
+| secure-op.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | security-decision.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | security-standards.md | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
-| security-testing.md | :x: | :x: |
-| self-review-protocol.md | :x: | :white_check_mark: ? |
-| server-ops-security.md | :x: | :x: |
+| security-testing.md | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
+| self-review-protocol.md | :white_check_mark: 1.1.0 | :white_check_mark: 1.1.0 |
+| server-ops-security.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | skill-standard-alignment-check.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| slo-sli.md | :x: | :white_check_mark: 1.0.0 |
 | slo-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| smoke-test.md | :x: | :x: |
-| spec-driven-development.md | :white_check_mark: 2.2.0 | :white_check_mark: 2.2.0 |
+| smoke-test.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| spec-driven-development.md | :white_check_mark: 2.3.0 | :white_check_mark: 2.3.0 |
 | standard-admission-criteria.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | standard-lifecycle-management.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | structured-task-definition.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| supply-chain-attestation.md | :x: | :x: |
+| supply-chain-attestation.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | supply-chain-security-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | systematic-debugging.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | tech-debt-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
@@ -193,28 +213,25 @@
 | timeout-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | token-budget.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | translation-lifecycle-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
+| user-journey-testing.md | :x: | :white_check_mark: 1.0.0 |
+| user-story-mapping.md | :x: | :white_check_mark: 1.0.0 |
 | verification-evidence.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
-| versioning.md | :white_check_mark: 1.2.0 | :white_check_mark: 1.2.0 |
+| verification-oracle.md | :x: | :white_check_mark: 1.0.0 |
+| versioning.md | :warning: 1.2.0 (drift 3m) | :white_check_mark: 1.5.0 |
 | virtual-organization-standards.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | workflow-enforcement.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 | workflow-state-protocol.md | :white_check_mark: 1.0.0 | :white_check_mark: 1.0.0 |
 
-**zh-CN core coverage**: 90/127 (71%)
-**zh-TW core coverage**: 96/127 (76%)
+**zh-CN core coverage**: 128/149 (86%)
+**zh-TW core coverage**: 146/149 (98%)
 
 ## Drift Warnings
 
 Locale variants whose `translation_version` lags `source_version` by more than 2 minor versions, or by any major version. (Per XSPEC-239 Chimera Prevention — `translation-drift-warn`.)
 
-### zh-TW
+### zh-CN
 
-- **skill/orchestrate**: translation `1.0.0` vs source `2.0.0` (major-version gap)
-- **skill/plan**: translation `1.0.0` vs source `2.0.0` (major-version gap)
-- **skill/push**: translation `1.0.0` vs source `2.0.0` (major-version gap)
-- **core/browser-compatibility-standards.md**: translation `0.0.0` vs source `1.0.0` (major-version gap)
-- **core/contract-testing-standards.md**: translation `0.0.0` vs source `1.0.0` (major-version gap)
-- **core/cross-flow-regression.md**: translation `0.0.0` vs source `1.0.0` (major-version gap)
-- **core/release-readiness-gate.md**: translation `0.0.0` vs source `1.0.0` (major-version gap)
+- **core/versioning.md**: translation `1.2.0` vs source `1.5.0` (3 minor versions behind)
 
 ## Legend