universal-dev-standards 6.13.0-beta.2 → 6.13.0-beta.4

package/bundled/ai/standards/turn-completion-integrity.ai.yaml

@@ -4,7 +4,7 @@
 id: turn-completion-integrity
 meta:
   version: "1.4.0"
-  updated: "2026-09-25"
+  updated: "2026-09-26"
   source: core/turn-completion-integrity.md
   description: An agent must not end a turn having stated a next action it did not take; enforced at turn end, not by instruction
   related:

package/bundled/hooks/turn-completion/engine.mjs

@@ -14,7 +14,7 @@
 import { readFileSync, mkdirSync, writeFileSync, existsSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import { detectCommitment, userAskedToStop } from './detect.mjs';
 
 export const VERSION = '1.2.0';
@@ -53,7 +53,16 @@ export async function loadPacks() {
   const failed = [];
   for (const id of SHIPPED_LOCALES) {
     try {
-      packs.push(await import(join(HERE, 'locales', `${id}.mjs`)));
+      // A filesystem path (`C:\...` on Windows) is not a valid ESM import
+      // specifier — dynamic `import()` needs a `file://` URL there. On
+      // POSIX both happen to look like absolute paths that Node accepts, so
+      // this went unnoticed until measured 2026-09-27 in CI
+      // (windows-latest): every pack failed to load, `failed` was silently
+      // non-empty, and every adapter test that expects a block/deny decision
+      // got `undefined` instead — the hook ran, found no packs, and let
+      // every turn end uninspected. pathToFileURL(...).href is the one
+      // form valid on every platform.
+      packs.push(await import(pathToFileURL(join(HERE, 'locales', `${id}.mjs`)).href));
     } catch (e) {
       failed.push({ id, why: String((e && e.message) || e) });
     }

package/bundled/locales/zh-CN/CHANGELOG.md

@@ -1,8 +1,8 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.13.0-beta.2
-translation_version: 6.13.0-beta.2
-last_synced: 2026-09-26
+source_version: 6.13.0-beta.4
+translation_version: 6.13.0-beta.4
+last_synced: 2026-09-27
 status: current
 ---
 
@@ -17,6 +17,27 @@ status: current
 
 ## [Unreleased]
 
+## [6.13.0-beta.4] - 2026-09-28
+
+> **测试版** — 以 `npm install -g universal-dev-standards@beta` 安装。要测什么、已知限制、如何退回正式版：见 [docs/PRE-RELEASE.md](../../docs/PRE-RELEASE.md)。注意：6.13.0-beta.3 从未上架 npm，其内容随本版发布。
+
+### 修复
+
+- **`turn-completion-integrity` 的 Stop hook 在 Windows 上一路到 6.13.0-beta.3 都静默失效——它照跑、找不到任何语言包、然后放行每一轮对话，且什么都不打印。** `engine.mjs` 的 `loadPacks()` 用 `join(HERE, 'locales', ...)` 拼出每个语言包的路径，直接把这个文件系统路径交给动态 `import()`；在 Windows 上那是 `C:\...` 这种路径，不是合法的 ESM import 指定字符串（POSIX 上的绝对路径恰好也能被解析成合法指定字符串，这正是为何在 macOS/Linux 上从未被发现）。2026-09-27 于 CI（windows-latest）实测：每一个出货的语言包都加载失败，而每一个原本该回 `block`/`deny` 决策的适配层（Claude Code、Codex、Gemini CLI）全部返回 `undefined`。修复方式改用 `pathToFileURL(...).href`，与 `cli/src/utils/standard-fixer.js`／`standard-validator.js` 既有的正确写法一致。四支 `scripts/check-*.ts` 开发工具脚本有同样的写法（Windows CI job 不会跑到它们，因为它们只在 `ubuntu-latest` 上执行，但那里同样是坏的），一并以同样方式修正。新增一支全 repo 走查测试（`cli/tests/unit/scripts/no-fs-path-dynamic-import.test.js`）扫描 `scripts/`、`cli/src/`、`cli/scripts/` 找这个写法，未来新增的一处不需要有人记得这次事故也会被挡下。
+- **由 `uds init` 写入的 husky 管理 `.husky/pre-commit`，即使 `core.hooksPath` 已正确接好，在 Windows 上一路到 6.13.0-beta.3 都会让每一次提交失败，错误是 `error: cannot spawn .husky/pre-commit: No such file or directory`。** husky v9 自己的模板没有 shebang 行，这在 macOS/Linux 上一直能用，因为 POSIX git 在脚本没有 shebang 时（`ENOEXEC`）会回退用 `/bin/sh` 执行；git for Windows 没有这个后备机制，完全无法对没有 shebang 的文件 spawn，而且错误信息指向 hook 文件本身而非缺失的解释器——很容易被误判成 wiring 问题而非内容问题。`uds init` 现在会在缺少 shebang 时，于 husky 管理的 hook 最前面补上 `#!/bin/sh`，不分平台一律如此，无论是写新 hook 还是动到既有的采用者文件（只会插入，绝不重写采用者自己的 shebang 或任何其他行）。`uds check` 的 `[pre-commit]` 警告新增 `missingShebang` 信号，独立于 wiring 报告（一个 hook 可以完全接好但在 Windows 上仍因此失败），且维持既有设计，只读不写。
+
+## [6.13.0-beta.3] - 2026-09-27
+
+> **测试版** — 以 `npm install -g universal-dev-standards@beta` 安装。要测什么、已知限制、如何退回正式版：见 [docs/PRE-RELEASE.md](../../docs/PRE-RELEASE.md)。
+
+### Fixed
+
+- **`uds init` 会写入提交前检查（`.husky/pre-commit`，非 Node 项目则为 `.git/hooks/pre-commit`），却从未确认 git 真的会执行它。** 它依赖 husky 自己的 bootstrap 机制——`npm install` 触发 husky 的 `prepare` script 去设定 `core.hooksPath`——而这个时机只在**下一次** `npm install` 执行时才会发生；如果 `node_modules` 早就存在，这件事就永远不会发生。实测三个既有采用者（asiaostrich-telemetry-server、asiaostrich-telemetry-client、machine-setup，2026-09-26）：三者都有调用 `npx uds check` 的 `.husky/pre-commit`，但 `core.hooksPath` 均未设定，提交时检查从未跑过——而且完全没有任何错误信息。`uds init` 现在不再替用户安装 husky 或改动 package.json 的依赖；改为直接执行 `git config --local core.hooksPath .husky`（与 husky 自己 bootstrap 内部所做的事完全相同），让检查在 `uds init` 执行完就立刻生效，无论 husky 有没有安装。绝不覆盖用户既有的 `core.hooksPath`，或既有的 `.git/hooks/pre-commit`——两者都会被保留原状，并打印信息说明检查**未启用**及原因。非 Node 项目的原生 hook 路径也不再无条件覆写既有的 `.git/hooks/pre-commit`（过去会）。新增 `uds check` 警告 `[pre-commit]`：检测 UDS 写入的检查文件存在，但实际不在 git 真正会执行的路径上（涵盖直接设定、husky 自己的 `<dir>/_` shim 转发、以及原生默认路径三种形状），并附上修复方式——这就是像上述三个既有采用者这样“已经中招”的项目能发现问题的渠道。此警告仅提示、不影响 `uds check --ci` 的退出码，因为这是每个 clone 各自的本机设定落差，不是标准本身不合规。`core.hooksPath` 不会进版控，所以这道启用只对执行 `uds init` 的那个 clone 生效——信息与新警告都会说明这一点。
+
+- **后续修正（2026-09-27）：上面那个修法，若既有采用者手上的 `.husky/pre-commit` 还是 husky v8 旧模板（含 `_/husky.sh` 那一行），照做反而会让每一次提交都失败。** 实测其中一个既有采用者的一次性 clone：照 `uds check` 原本建议的修法（`git config --local core.hooksPath .husky`）执行，结果打印 `.husky/pre-commit: line 2: .husky/_/husky.sh: No such file or directory`，`git commit` 以 exit 1 失败——比原本“静默不跑”的缺陷更糟，因为 `.husky/_/` 这个目录只有在 husky 自己的 bootstrap 真的跑过后才存在，而直接把 `core.hooksPath` 设成 `.husky` 会让 git 原封不动地执行这个文件。`uds init` 的 `setupHuskyHook` 现在会检测并移除这一行后再改写 `.husky/pre-commit`（其余内容——用户自己加的命令、既有的 `uds check` 那一行——全部保留）；`uds check` 的 `[pre-commit]` 警告检测到这种旧模板时，不再只单独建议设定 hooksPath，改为给出“先删那一行、再设定 hooksPath”的两步修法——因为 `uds init` 对已初始化的项目会直接拒绝执行，修不了这三个既有采用者的问题。`git-hooks.js` 新增共用函数 `hasLegacyHuskyShLine`／`stripLegacyHuskyShLine`。
+
+- **`bump-version.mjs` 在“预发布→预发布”的版本升版时，把 `SECURITY.md`“最新正式版”那一行标错——实测发生于 6.13.0-beta.2 发版当下（2026-09-26），当时以手动更正。** 它的 `SECURITY.md` 修补逻辑找“裸版号（无后缀）那一行”来认定是正式版行；新的预发布版号（如 `6.13.0-beta.2`）永远带着连字符、永远不会符合“裸版号”，于是修补逻辑退而求其次改到唯一真正裸版号的那一行——也就是不相关的正式版行——把它的版号换成新的预发布版号，而原本该更新、已经过期的预发布行（仍是 `6.13.0-beta.1`）反而原封不动。已将产生表格的逻辑（`generate-docs.mjs` 原本就写对、但 `bump-version.mjs` 未使用）抽成共用的 `scripts/lib/security-versions.mjs`，两支脚本现在都改成用 `(version, stableVersion)` 整段重新产生 2 或 3 行的表格，而不是找一行去 patch——已针对全部四种版本类型转换（正式→正式、正式→预发布、预发布→预发布、预发布→正式）、三种语言，通过对隔离副本执行一次真正的端到端 `bump-version.mjs` 验证正确。`check-version-sync.sh` 原本的 SECURITY.md 检查只比对第一行数据的版号是否等于 `package.json`（一种位置代理，恰好抓到了这次事故）；现在还会逐行比对“标签”与“该行版号的形状”是否吻合（“最新正式版／Latest stable”行若版号带连字符、或“预发布版本／Pre-release”行若版号不带连字符，即使位置检查会通过，仍会被标记为错误）。
+
 ## [6.13.0-beta.2] - 2026-09-26
 
 > **测试版** — 以 `npm install -g universal-dev-standards@beta` 安装。要测什么、已知限制、如何退回正式版：见 [docs/PRE-RELEASE.md](../../docs/PRE-RELEASE.md)。

package/bundled/locales/zh-CN/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **语言**: [English](../../README.md) | [繁體中文](../zh-TW/README.md) | 简体中文
 
-**版本**: 6.13.0-beta.2 (Pre-release) | **发布日期**: 2026-09-26 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.13.0-beta.4 (Pre-release) | **发布日期**: 2026-09-28 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
 
 语言无关、框架无关的软件项目文档标准。通过 AI 原生工作流，确保不同技术栈之间的一致性、质量和可维护性。
 

package/bundled/locales/zh-CN/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支持状态 |
 |------|--------|
-| 6.13.0-beta.2 | ✅ 预发布版本 |
+| 6.13.0-beta.4 | ✅ 预发布版本 |
 | 6.12.0 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已终止支持 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->

package/bundled/locales/zh-CN/docs/CLI-INIT-OPTIONS.md

@@ -1,8 +1,8 @@
 ---
 source: ../../../docs/CLI-INIT-OPTIONS.md
-source_version: 3.6.0
-translation_version: 3.6.0
-last_synced: 2026-09-25
+source_version: 3.7.0
+translation_version: 3.7.0
+last_synced: 2026-09-26
 status: current
 ---
 
@@ -10,8 +10,8 @@ status: current
 
 > **语言**: [English](../../../docs/CLI-INIT-OPTIONS.md) | [简体中文](../../zh-TW/docs/CLI-INIT-OPTIONS.md) | 简体中文
 >
-> **版本**: 3.6.0
-> **最后更新**: 2026-09-25
+> **版本**: 3.7.0
+> **最后更新**: 2026-09-26
 
 本文档详细说明 `uds init` 命令的每一个选项，包含使用情境、影响范围和建议选择。
 
@@ -838,6 +838,34 @@ uds init --experimental
 | Claude Code 目标文件 | `--claude-target` | Claude Code 集成内容要写到哪里：`project`（`CLAUDE.md`，默认）或 `local`（`CLAUDE.local.md`） |
 | 模式（已弃用） | `-m, --mode` | 安装模式（skills, full）- 请改用 `--skills-location` |
 
+### 提交前标准检查（git hook 接线）
+
+`uds init` 一律会设定“`git commit` 时跑 `uds check`”——这不是标志，只要项目
+是 git 仓库就会执行。Node.js 项目（检测到 `package.json`）写入
+`.husky/pre-commit`，否则写入 `.git/hooks/pre-commit`，接着会确保 git 真的
+会执行它：设定 `git config --local core.hooksPath .husky`（非 Node 项目则
+保留原生 `.git/hooks` 默认不动）——这与 husky 自己的 `npx husky` bootstrap
+内部所做的事完全相同，只是直接做，让检查立刻生效，不论最后有没有装 husky。
+
+以下两件事是刻意不做的：
+
+- **替你安装 husky，或改动 `package.json` 的依赖。** husky 要不要作为依赖
+  由你决定；上面的接线不论有没有 husky 都能运作。若项目已经把 husky 列为
+  依赖，`uds init` 也会顺手串接它的 `prepare` script（`"prepare": "既有内容
+  && husky"`），让未来的 `npm install` 也保持 husky 自己的 bootstrap 同步
+  ——这是锦上添花，不是这道接线能否生效的关键。
+- **覆盖你自己的 git hook 设定。** 若 `core.hooksPath` 已经指向别处，或
+  `.git/hooks/pre-commit` 已经存在，`uds init` 会两者都不动，并打印检查
+  **未启用**及原因。
+
+`git config core.hooksPath` 是**本机、per-clone 的设定——不会进版控。**
+跑 `uds init` 只会让“跑过这个命令的那个 clone”生效；其他人 clone 这个
+仓库后要自己再跑一次 `uds init`（或 `uds check` 打印的那一行修复命令）。
+`uds check` 会检测“`.husky/pre-commit`／`.git/hooks/pre-commit` 存在，但
+实际不在 git 真正会执行的路径上”的情况——包含在这次修复之前就已采用
+UDS 的项目——并在 `[pre-commit]` 下回报同样的修复方式；此警告不影响
+`uds check --ci` 的退出码。
+
 ### Claude Code 以外的强制执行 Hooks
 
 `--with-hooks` 一定会安装进 `.claude/settings.json`。四个有 hook 支持的标准

package/bundled/locales/zh-TW/CHANGELOG.md

@@ -1,8 +1,8 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.13.0-beta.2
-translation_version: 6.13.0-beta.2
-last_synced: 2026-09-26
+source_version: 6.13.0-beta.4
+translation_version: 6.13.0-beta.4
+last_synced: 2026-09-27
 status: current
 ---
 
@@ -17,6 +17,27 @@ status: current
 
 ## [Unreleased]
 
+## [6.13.0-beta.4] - 2026-09-28
+
+> **測試版** — 以 `npm install -g universal-dev-standards@beta` 安裝。要測什麼、已知限制、如何退回正式版：見 [docs/PRE-RELEASE.md](../../docs/PRE-RELEASE.md)。注意：6.13.0-beta.3 從未上架 npm，其內容隨本版出貨。
+
+### 修復
+
+- **`turn-completion-integrity` 的 Stop hook 在 Windows 上一路到 6.13.0-beta.3 都靜默失效——它照跑、找不到任何語言包、然後放行每一輪對話，且什麼都不印。** `engine.mjs` 的 `loadPacks()` 用 `join(HERE, 'locales', ...)` 組出每個語言包的路徑，直接把這個檔案系統路徑交給動態 `import()`；在 Windows 上那是 `C:\...` 這種路徑，不是合法的 ESM import 指定字串（POSIX 上的絕對路徑恰好也能被解析成合法指定字串，這正是為何在 macOS/Linux 上從未被發現）。2026-09-27 於 CI（windows-latest）實測：每一個出貨的語言包都載入失敗，而每一個原本該回 `block`/`deny` 決策的介接層（Claude Code、Codex、Gemini CLI）全部回傳 `undefined`。修法改用 `pathToFileURL(...).href`，與 `cli/src/utils/standard-fixer.js`／`standard-validator.js` 既有的正確寫法一致。四支 `scripts/check-*.ts` 開發工具腳本有同樣的寫法（Windows CI job 不會跑到它們，因為它們只在 `ubuntu-latest` 上執行，但那裡同樣是壞的），一併以同樣方式修正。新增一支全 repo 走訪測試（`cli/tests/unit/scripts/no-fs-path-dynamic-import.test.js`）掃描 `scripts/`、`cli/src/`、`cli/scripts/` 找這個寫法，未來新增的一處不需要有人記得這次事故也會被擋下。
+- **由 `uds init` 寫入的 husky 管理 `.husky/pre-commit`，即使 `core.hooksPath` 已正確接好，在 Windows 上一路到 6.13.0-beta.3 都會讓每一次提交失敗，錯誤是 `error: cannot spawn .husky/pre-commit: No such file or directory`。** husky v9 自己的範本沒有 shebang 行，這在 macOS/Linux 上一直能動，因為 POSIX git 在腳本沒有 shebang 時（`ENOEXEC`）會退回用 `/bin/sh` 執行；git for Windows 沒有這個後備機制，完全無法對沒有 shebang 的檔案 spawn，而且錯誤訊息指向 hook 檔本身而非缺少的直譯器——很容易被誤判成 wiring 問題而非內容問題。`uds init` 現在會在缺少 shebang 時，於 husky 管理的 hook 最前面補上 `#!/bin/sh`，不分平台一律如此，無論是寫新 hook 還是動到既有的採用者檔案（只會插入，絕不重寫採用者自己的 shebang 或任何其他行）。`uds check` 的 `[pre-commit]` 警告新增 `missingShebang` 訊號，獨立於 wiring 回報（一個 hook 可以完全接好但在 Windows 上仍因此失敗），且維持既有設計，只讀不寫。
+
+## [6.13.0-beta.3] - 2026-09-27
+
+> **測試版** — 以 `npm install -g universal-dev-standards@beta` 安裝。要測什麼、已知限制、如何退回正式版：見 [docs/PRE-RELEASE.md](../../docs/PRE-RELEASE.md)。
+
+### Fixed
+
+- **`uds init` 會寫入提交前檢查（`.husky/pre-commit`，非 Node 專案則為 `.git/hooks/pre-commit`），卻從未確認 git 真的會執行它。** 它依賴 husky 自己的 bootstrap 機制——`npm install` 觸發 husky 的 `prepare` script 去設定 `core.hooksPath`——而這個時機只在**下一次** `npm install` 執行時才會發生；如果 `node_modules` 早就存在，這件事就永遠不會發生。實測三個既有採用者（asiaostrich-telemetry-server、asiaostrich-telemetry-client、machine-setup，2026-09-26）：三者都有呼叫 `npx uds check` 的 `.husky/pre-commit`，但 `core.hooksPath` 皆未設定，提交時檢查從未跑過——而且完全沒有任何錯誤訊息。`uds init` 現在不再替使用者安裝 husky 或改動 package.json 的依賴；改成直接執行 `git config --local core.hooksPath .husky`（與 husky 自己 bootstrap 內部做的事完全相同），讓檢查在 `uds init` 執行完就立刻生效，無論 husky 有沒有裝。絕不覆蓋使用者既有的 `core.hooksPath`，或既有的 `.git/hooks/pre-commit`——兩者都會被保留原狀，並印出訊息說明檢查**未啟用**及原因。非 Node 專案的原生 hook 路徑也不再無條件覆寫既有的 `.git/hooks/pre-commit`（過去會）。新增 `uds check` 警告 `[pre-commit]`：偵測 UDS 寫入的檢查檔存在，但實際不在 git 真正會執行的路徑上（涵蓋直接設定、husky 自己的 `<dir>/_` shim 轉呼叫、以及原生預設路徑三種形狀），並附上修復方式——這就是像上述三個既有採用者這樣「已經中招」的專案能發現問題的管道。此警告只提示不影響 `uds check --ci` 的結束碼，因為這是每個 clone 各自的本機設定落差，不是標準本身不合規。`core.hooksPath` 不會進版控，所以這道啟用只對執行 `uds init` 的那個 clone 生效——訊息與新警告都會說明這一點。
+
+- **後續修正（2026-09-27）：上面那個修法，若既有採用者手上的 `.husky/pre-commit` 還是 husky v8 舊範本（含 `_/husky.sh` 那一行），照做反而會讓每一次提交都失敗。** 實測其中一個既有採用者的拋棄式 clone：照 `uds check` 原本建議的修法（`git config --local core.hooksPath .husky`）執行，結果印出 `.husky/pre-commit: line 2: .husky/_/husky.sh: No such file or directory`，`git commit` 以 exit 1 失敗——比原本「靜默不跑」的缺陷更糟，因為 `.husky/_/` 這個目錄只有在 husky 自己的 bootstrap 真的跑過後才存在，而直接把 `core.hooksPath` 設成 `.husky` 會讓 git 原封不動地執行這個檔案。`uds init` 的 `setupHuskyHook` 現在會偵測並移除這一行後再改寫 `.husky/pre-commit`（其餘內容——使用者自己加的指令、既有的 `uds check` 那一行——全部保留）；`uds check` 的 `[pre-commit]` 警告偵測到這種舊範本時，不再只單獨建議設定 hooksPath，改成給「先刪那一行、再設定 hooksPath」的兩步修法——因為 `uds init` 對已初始化的專案會直接拒絕執行，修不了這三個既有採用者的問題。`git-hooks.js` 新增共用函式 `hasLegacyHuskyShLine`／`stripLegacyHuskyShLine`。
+
+- **`bump-version.mjs` 在「預發布→預發布」的版本升版時，把 `SECURITY.md`「最新正式版」那一列標錯——實測發生於 6.13.0-beta.2 發版當下（2026-09-26），當時以手動更正。** 它的 `SECURITY.md` 修補邏輯找「裸版號（無尾碼）那一列」來認定是正式版列；新的預發布版號（如 `6.13.0-beta.2`）永遠帶著連字號、永遠不會符合「裸版號」，於是修補邏輯退而求其次改到唯一真正裸版號的那一列——也就是不相關的正式版列——把它的版號換成新的預發布版號，而原本該更新、已經過期的預發布列（仍是 `6.13.0-beta.1`）反而原封不動。已將產生表格的邏輯（`generate-docs.mjs` 原本就寫對、但 `bump-version.mjs` 未使用）抽成共用的 `scripts/lib/security-versions.mjs`，兩支腳本現在都改成用 `(version, stableVersion)` 整段重新產生 2 或 3 列的表格，而不是找一列去 patch——已針對全部四種版本型態轉換（正式→正式、正式→預發布、預發布→預發布、預發布→正式）、三種語言，透過對隔離複本執行一次真正的端到端 `bump-version.mjs` 驗證正確。`check-version-sync.sh` 原本的 SECURITY.md 檢查只比對第一列資料的版號是否等於 `package.json`（一種位置代理，恰好抓到了這次事故）；現在還會逐列比對「標籤」與「該列版號的形狀」是否吻合（「最新正式版／Latest stable」列若版號帶連字號、或「預發布版本／Pre-release」列若版號不帶連字號，即使位置檢查會通過，仍會被標記為錯誤）。
+
 ## [6.13.0-beta.2] - 2026-09-26
 
 > **測試版** — 以 `npm install -g universal-dev-standards@beta` 安裝。要測什麼、已知限制、如何退回正式版：見 [docs/PRE-RELEASE.md](../../docs/PRE-RELEASE.md)。

package/bundled/locales/zh-TW/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **語言**: [English](../../README.md) | 繁體中文 | [简体中文](../zh-CN/README.md)
 
-**版本**: 6.13.0-beta.2 (Pre-release) | **發布日期**: 2026-09-26 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.13.0-beta.4 (Pre-release) | **發布日期**: 2026-09-28 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
 
 語言無關、框架無關的軟體專案文件標準。透過 AI 原生工作流，確保不同技術堆疊之間的一致性、品質和可維護性。
 

package/bundled/locales/zh-TW/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支援狀態 |
 |------|--------|
-| 6.13.0-beta.2 | ✅ 預發布版本 |
+| 6.13.0-beta.4 | ✅ 預發布版本 |
 | 6.12.0 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已終止支援 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->

package/bundled/locales/zh-TW/docs/CLI-INIT-OPTIONS.md

@@ -1,8 +1,8 @@
 ---
 source: ../../../docs/CLI-INIT-OPTIONS.md
-source_version: 3.6.0
-translation_version: 3.6.0
-last_synced: 2026-09-25
+source_version: 3.7.0
+translation_version: 3.7.0
+last_synced: 2026-09-26
 status: current
 ---
 
@@ -10,8 +10,8 @@ status: current
 
 > **語言**: [English](../../../docs/CLI-INIT-OPTIONS.md) | 繁體中文 | [简体中文](../../zh-CN/docs/CLI-INIT-OPTIONS.md)
 >
-> **版本**: 3.6.0
-> **最後更新**: 2026-09-25
+> **版本**: 3.7.0
+> **最後更新**: 2026-09-26
 
 本文件詳細說明 `uds init` 命令的每一個選項，包含使用情境、影響範圍和建議選擇。
 
@@ -838,6 +838,34 @@ uds init --experimental
 | Claude Code 目標檔 | `--claude-target` | Claude Code 整合內容要寫到哪裡：`project`（`CLAUDE.md`，預設）或 `local`（`CLAUDE.local.md`） |
 | 模式（已棄用） | `-m, --mode` | 安裝模式（skills, full）- 請改用 `--skills-location` |
 
+### 提交前標準檢查（git hook 接線）
+
+`uds init`一律會設定「`git commit` 時跑 `uds check`」——這不是旗標，只要專案是
+git repo 就會執行。Node.js 專案（偵測到 `package.json`）寫入
+`.husky/pre-commit`，否則寫入 `.git/hooks/pre-commit`，接著會確保 git 真的會
+執行它：設定 `git config --local core.hooksPath .husky`（非 Node 專案則保留
+原生 `.git/hooks` 預設不動）——這與 husky 自己的 `npx husky` bootstrap 內部
+做的事完全相同，只是直接做，讓檢查立刻生效，不論最後有沒有裝 husky。
+
+以下兩件事是刻意不做的：
+
+- **替你安裝 husky，或動 `package.json` 的依賴。** husky 要不要是依賴由你
+  決定；上面的接線不論有沒有 husky 都能運作。若專案已經把 husky 列為依賴，
+  `uds init` 也會順手串接它的 `prepare` script（`"prepare": "既有內容 &&
+  husky"`），讓未來的 `npm install` 也保持 husky 自己的 bootstrap 同步——
+  這是錦上添花，不是這道接線能不能生效的關鍵。
+- **覆蓋你自己的 git hook 設定。** 若 `core.hooksPath` 已經指向別處，或
+  `.git/hooks/pre-commit` 已經存在，`uds init` 會兩者都不動，並印出檢查
+  **未啟用**及原因。
+
+`git config core.hooksPath` 是**本機、per-clone 的設定——不會進版控。**
+跑 `uds init` 只會讓「跑過這個指令的那個 clone」生效；其他人 clone 這個
+repo 後要自己再跑一次 `uds init`（或 `uds check` 印出的那一行修復指令）。
+`uds check` 會偵測「`.husky/pre-commit`／`.git/hooks/pre-commit` 存在，
+但實際不在 git 真正會執行的路徑上」的情況——包含在這個修正之前就已採用
+UDS 的專案——並在 `[pre-commit]` 底下回報同樣的修復方式；此警告不影響
+`uds check --ci` 的結束碼。
+
 ### Claude Code 以外的強制執行 Hooks
 
 `--with-hooks` 一定會安裝進 `.claude/settings.json`。四個有 hook 支援的標準

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-dev-standards",
-  "version": "6.13.0-beta.2",
+  "version": "6.13.0-beta.4",
   "description": "CLI tool for adopting Universal Development Standards",
   "keywords": [
     "documentation",

package/src/commands/check.js

@@ -45,6 +45,7 @@ import { t, setLanguage, isLanguageExplicitlySet } from '../i18n/messages.js';
 import { guardAgainstSelfAdoption } from '../utils/detect-self-adoption.js';
 import { lintAll as lintI18nAll, partitionFindings as partitionI18nFindings } from '../lint/i18n.js';
 import { resolveIntegrationFile } from '../core/constants.js';
+import { checkPreCommitHookWiring } from '../utils/git-hooks.js';
 
 /**
  * Display the summary of file integrity status
@@ -509,6 +510,9 @@ export async function checkCommand(options = {}) {
   // 錯誤訊息單一出口閘門是否已安裝（只報告，不寫入）
   checkErrorExitGate(projectPath);
 
+  // pre-commit 檢查檔存在，但 git 實際不會執行它（只報告，不寫入 —— 見 checkPreCommitWiring 下方註解）
+  checkPreCommitWiring(projectPath, msg);
+
   // Workflow status
   displayWorkflowStatus(projectPath);
 
@@ -1252,6 +1256,81 @@ function checkErrorExitGate(projectPath) {
   console.log();
 }
 
+/**
+ * pre-commit 檢查檔存在，但 git 實際不會執行它：偵測並報告，絕不寫入。
+ *
+ * 🔴 起因：`uds init` 會寫 `.husky/pre-commit`（或非 Node 專案的
+ * `.git/hooks/pre-commit`），但過去從未確認 git 真的會執行它——它依賴 husky
+ * 自己的 bootstrap（`npm install` 觸發 `prepare` script 設定
+ * `core.hooksPath`），而那個時機點如果 `node_modules` 已存在就永遠不會再發生。
+ * 2026-09-26 實測三個既有採用者（asiaostrich-telemetry-server、
+ * asiaostrich-telemetry-client、machine-setup）：三者都有呼叫
+ * `npx uds check` 的 `.husky/pre-commit`，但 `core.hooksPath` 皆未設定，
+ * 提交時檢查從未跑過，且沒有任何錯誤訊息——這正是這道檢查要補上的訊號。
+ *
+ * 只報告不寫入的理由與 checkErrorExitGate 相同：`uds check` 不是使用者同意我們
+ * 動他 git 設定的時刻；真要修，`uds init`（新 clone／尚未跑過）或使用者自己
+ * 手動下指令（既有 clone）才是合適的落筆點。
+ *
+ * 🔴 刻意不影響 `allGood` / `--ci` 的 exit code：這是一個既有裝置的健康度警告
+ * （類似 checkErrorExitGate、checkFullCoverageCompliance 的既有慣例），不是
+ * 標準本身的落差，翻動 exit code 會讓不相關的 CI pipeline 因為一個提交前檢查
+ * 的本機設定而失敗，而那個設定本來就是 per-clone、CI 環境通常另有一套。
+ */
+export function checkPreCommitWiring(projectPath, msg) {
+  const result = checkPreCommitHookWiring(projectPath);
+  if (!result.relevant) return; // 沒有 UDS 管理的 hook
+
+  if (result.wired) {
+    // 🔴 「已確認會執行」在 POSIX 上為真，在 Windows 上不一定——git for
+    // Windows 沒有 POSIX 的 ENOEXEC → /bin/sh 後備機制，缺 shebang 的 hook
+    // 每次 commit 都會失敗，訊息卻指向 hook 檔本身
+    // （`cannot spawn <file>: No such file or directory`），2026-09-27 實測
+    // 於 CI windows-latest。這與「wiring」是兩個獨立的缺陷面，有各自的旗標。
+    if (result.missingShebang) {
+      console.log(chalk.yellow((msg.hookMissingShebangTitle || '⚠ [pre-commit] {file} has no shebang line — git cannot run it on Windows.')
+        .replace('{file}', result.hookFile)));
+      console.log(chalk.gray((msg.hookMissingShebangFix || '').replace(/\{file\}/g, result.hookFile)));
+      console.log();
+    }
+    return; // 已確認會執行——wiring 本身安靜通過
+  }
+
+  console.log(chalk.yellow((msg.hookNotWiredTitle || '⚠ [pre-commit] {file} was installed, but git will not run it.')
+    .replace('{file}', result.hookFile)));
+
+  if (result.configuredHooksPath) {
+    const key = result.hookFile === '.git/hooks/pre-commit' ? 'hookNotWiredFixNative' : 'hookNotWiredOverride';
+    console.log(chalk.gray((msg[key] || '').replace('{path}', result.configuredHooksPath)));
+    // 🔴 legacy 舊範本即使在 override 分支也要提醒——一旦使用者照上面那行改用
+    // .husky，同一個 `_/husky.sh` 陷阱一樣會炸。絕不能只在「非 override」分支講。
+    if (result.legacyV8) {
+      console.log(chalk.gray((msg.hookNotWiredLegacyV8Fix || '').replace(/\{file\}/g, result.hookFile)));
+    }
+  } else if (result.legacyV8) {
+    // 🔴 這是 2026-09-27 的實測教訓：舊 husky v8 範本（含 `_/husky.sh` source
+    // 那一行）若只給「設定 core.hooksPath」這個修法，使用者照做後 git 會直接
+    // 執行這個檔案、卡死在那一行、每次 commit 都失敗——比原本的缺陷更糟。
+    // 這裡絕不能退化成只印 hookNotWiredFix；一定要用把「先刪行、再設定」
+    // 兩步講完整的版本。`uds init` 對已初始化專案會直接拒絕執行，修不了這個，
+    // 所以這裡的文字必須自己講完整，不能叫使用者去跑別的指令。
+    console.log(chalk.gray((msg.hookNotWiredFixLegacy || '').replace(/\{file\}/g, result.hookFile)));
+  } else {
+    console.log(chalk.gray((msg.hookNotWiredUnwired || '').replace('{file}', result.hookFile)));
+    console.log(chalk.gray(msg.hookNotWiredFix || ''));
+  }
+
+  // Independent of wiring — a hook can be fully wired for commit and still
+  // fail every commit on Windows if it has no shebang (see the `wired`
+  // branch above for why). Say so here too so fixing wiring alone does not
+  // look like a complete fix.
+  if (result.missingShebang) {
+    console.log(chalk.gray((msg.hookMissingShebangFix || '').replace(/\{file\}/g, result.hookFile)));
+  }
+
+  console.log();
+}
+
 /**
  * XSPEC-178: Check full-coverage-testing standard presence and STUB markers
  */

package/src/commands/init.js

@@ -28,6 +28,7 @@ import { guardAgainstSelfAdoption } from '../utils/detect-self-adoption.js';
 import { readInstallYaml } from '../utils/config-manager.js';
 import { resolveIntegrationTargetFile } from '../utils/integration-generator.js';
 import { withFileTransaction } from '../utils/transaction.js';
+import { wireGitHooksPath, getLocalHooksPathConfig, stripLegacyHuskyShLine, ensureShebang } from '../utils/git-hooks.js';
 
 /**
  * Init command - initialize standards in current project
@@ -339,32 +340,42 @@ export async function setupHuskyHook(projectPath, { allowInTest = false } = {})
   const isNodeProject = existsSync(join(projectPath, 'package.json'));
 
   if (isNodeProject) {
-    console.log(chalk.cyan('Configuring Pre-commit Hook (Husky)...'));
+    console.log(chalk.cyan('Configuring Pre-commit Hook...'));
 
     // Every edit we make to the adopter's package.json, reported at the end.
     // `uds init` writes ~70 files; a one-line change to package.json is invisible
     // in that diff unless we say it out loud (XSPEC-341 R1).
     const pkgChanges = [];
+    const pkgPath = join(projectPath, 'package.json');
 
-    // 1. Install husky if needed
+    // 1. Do NOT install husky, and do NOT touch package.json's dependencies.
+    //
+    // This used to run `npm install --save-dev husky` here. Installing a
+    // package for the adopter is not this command's call to make, and — the
+    // actual bug this fix addresses — the wiring that install produced only
+    // took effect the NEXT time `npm install` ran husky's own `prepare`
+    // script. If node_modules already existed, that install never ran again,
+    // and the hook this function writes below was never executed by git.
+    // Verified against three real adopters (asiaostrich-telemetry-server,
+    // asiaostrich-telemetry-client, machine-setup, 2026-09-26): all three
+    // have `.husky/pre-commit` calling `npx uds check`, none has
+    // `core.hooksPath` set, and the check has never once run on commit.
+    //
+    // Whether husky is installed is the adopter's own decision. Step 5 below
+    // wires git directly and works with or without it.
+    let hasHusky = false;
     try {
-      const pkgPath = join(projectPath, 'package.json');
       const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
-      const hasHusky = pkg.devDependencies?.husky || pkg.dependencies?.husky;
-
-      if (!hasHusky) {
-        console.log(chalk.gray('  Installing husky...'));
-        // stdio: 'pipe' rather than 'ignore' — the error text belongs in the
-        // message below, not in /dev/null.
-        execSync('npm install --save-dev husky', { stdio: 'pipe', cwd: projectPath });
-        pkgChanges.push('devDependencies.husky — added');
-      }
+      hasHusky = Boolean(pkg.devDependencies?.husky || pkg.dependencies?.husky);
     } catch (e) {
-      console.log(chalk.yellow(`  ⚠ Failed to check/install husky: ${e.message}`));
-      return;
+      console.log(chalk.yellow(`  ⚠ Failed to read package.json: ${e.message}`));
     }
 
-    // 2. Wire husky's `prepare` script ourselves.
+    // 2. If the adopter already depends on husky, also chain its `prepare`
+    // script so a future `npm install` keeps husky's own wiring in sync too.
+    // This is belt-and-suspenders — step 5 wires git directly regardless of
+    // whether this succeeds — kept only because an adopter who already uses
+    // husky should not have `npm install` silently stop maintaining it.
     //
     // We deliberately do NOT run `npx husky init` (XSPEC-341 R1). That command is a
     // one-time bootstrap for a NEW project, not an idempotent operation: it sets
@@ -375,30 +386,31 @@ export async function setupHuskyHook(projectPath, { allowInTest = false } = {})
     // (It also seeds .husky/pre-commit with `npm test`, a gate the adopter never asked
     // for.) Adopting a standards library must never rewrite the adopter's build.
     const huskyDir = join(projectPath, '.husky');
-    try {
-      const pkgPath = join(projectPath, 'package.json');
-      const raw = readFileSync(pkgPath, 'utf-8');
-      const pkg = JSON.parse(raw);
-      pkg.scripts = pkg.scripts || {};
-      const existing = pkg.scripts.prepare;
-
-      if (!existing) {
-        pkg.scripts.prepare = 'husky';
-        pkgChanges.push('scripts.prepare — added: "husky"');
-      } else if (!/\bhusky\b/.test(existing)) {
-        // Chain, never clobber. The adopter's command runs first and keeps its
-        // exit code meaningful.
-        pkg.scripts.prepare = `${existing} && husky`;
-        pkgChanges.push(`scripts.prepare — "${existing}" → "${pkg.scripts.prepare}"`);
-      }
+    if (hasHusky) {
+      try {
+        const raw = readFileSync(pkgPath, 'utf-8');
+        const pkg = JSON.parse(raw);
+        pkg.scripts = pkg.scripts || {};
+        const existing = pkg.scripts.prepare;
+
+        if (!existing) {
+          pkg.scripts.prepare = 'husky';
+          pkgChanges.push('scripts.prepare — added: "husky"');
+        } else if (!/\bhusky\b/.test(existing)) {
+          // Chain, never clobber. The adopter's command runs first and keeps its
+          // exit code meaningful.
+          pkg.scripts.prepare = `${existing} && husky`;
+          pkgChanges.push(`scripts.prepare — "${existing}" → "${pkg.scripts.prepare}"`);
+        }
 
-      if (pkg.scripts.prepare !== existing) {
-        // Preserve the file's trailing newline convention.
-        const indent = raw.match(/^\{\n(\s+)"/)?.[1]?.length ?? 2;
-        writeFileSync(pkgPath, JSON.stringify(pkg, null, indent) + (raw.endsWith('\n') ? '\n' : ''), 'utf-8');
+        if (pkg.scripts.prepare !== existing) {
+          // Preserve the file's trailing newline convention.
+          const indent = raw.match(/^\{\n(\s+)"/)?.[1]?.length ?? 2;
+          writeFileSync(pkgPath, JSON.stringify(pkg, null, indent) + (raw.endsWith('\n') ? '\n' : ''), 'utf-8');
+        }
+      } catch (e) {
+        console.log(chalk.yellow(`  ⚠ Failed to configure the prepare script: ${e.message}`));
       }
-    } catch (e) {
-      console.log(chalk.yellow(`  ⚠ Failed to configure the prepare script: ${e.message}`));
     }
 
     // 3. Ensure .husky directory exists
@@ -411,34 +423,97 @@ export async function setupHuskyHook(projectPath, { allowInTest = false } = {})
       }
     }
 
-    // 4. Add pre-commit hook
+    // 4. Add pre-commit hook content
     const preCommitPath = join(huskyDir, 'pre-commit');
     const udsCmd = 'npx uds check';
 
     try {
-      // husky v9 hooks are plain shell scripts: no shebang, no `_/husky.sh` sourcing
-      // (that is v8 syntax, deprecated in v9 and removed in v10). We install husky
-      // ^9, so a fresh hook must be v9-shaped. Existing files are appended to, never
-      // rewritten — their contents are the adopter's, not ours.
-      const content = existsSync(preCommitPath) ? readFileSync(preCommitPath, 'utf-8') : '';
-
-      if (!content.includes('uds check')) {
+      // husky v9's own templates carry no shebang, no `_/husky.sh` sourcing
+      // (that is v8 syntax, deprecated in v9 and removed in v10). Verified
+      // empirically (2026-09-26, macOS): git executes a hook file with no
+      // shebang directly and correctly propagates its exit code, once it is
+      // on git's hooks path — see step 5.
+      //
+      // 🔴 That verification did not cover Windows, and Windows behaves
+      // differently: POSIX git falls back to `/bin/sh` on ENOEXEC (a script
+      // with no shebang) — that fallback is why the shebang-less shape above
+      // has always worked on macOS and Linux. Git for Windows has no such
+      // fallback and fails EVERY commit with `error: cannot spawn
+      // <hookfile>: No such file or directory` (measured 2026-09-27 in CI,
+      // windows-latest). So a shebang is added below regardless of platform
+      // — cheap, harmless on POSIX, and required on Windows. Existing files
+      // are appended to, never rewritten — their contents are the adopter's,
+      // not ours; ensureShebang only ever prepends a missing first line.
+      let content = existsSync(preCommitPath) ? readFileSync(preCommitPath, 'utf-8') : '';
+
+      // A pre-existing file may still carry husky v8's `_/husky.sh` sourcing
+      // line (adopted before v9, or before this fix). That line references a
+      // directory (`.husky/_/`) that only exists after husky's OWN bootstrap
+      // has run — but step 5 below wires `core.hooksPath` straight at
+      // `.husky`, so git executes THIS FILE directly. Left in place, that
+      // line would make every commit fail with "No such file or directory" —
+      // strictly worse than the original defect (verified against a real
+      // adopter's exact legacy template, 2026-09-27). Rewrite it away rather
+      // than appending alongside it; everything else — the adopter's own
+      // commands, an existing `uds check` line — is preserved as-is.
+      const { content: destripped, removed: hadLegacyLine } = stripLegacyHuskyShLine(content);
+      content = destripped;
+
+      const needsAppend = !content.includes('uds check');
+      if (needsAppend) {
         const sep = content && !content.endsWith('\n') ? '\n' : '';
-        writeFileSync(preCommitPath, `${content}${sep}\n# UDS Standard Check\n${udsCmd}\n`, 'utf-8');
+        content = `${content}${sep}\n# UDS Standard Check\n${udsCmd}\n`;
+      }
+
+      const { content: shebanged, added: addedShebang } = ensureShebang(content);
+      content = shebanged;
+
+      if (hadLegacyLine || needsAppend || addedShebang) {
+        writeFileSync(preCommitPath, content, 'utf-8');
         try {
           execSync(`chmod +x ${preCommitPath}`);
         } catch {
           // Ignore chmod failures on systems that don't support it
         }
+      }
+
+      if (hadLegacyLine) {
+        console.log(chalk.yellow('  ⚠ Rewrote legacy husky v8 template: removed `_/husky.sh` sourcing (that directory only exists after husky\'s own bootstrap runs; git now executes this file directly, so that line would have failed every commit).'));
+      }
+      if (addedShebang) {
+        console.log(chalk.yellow('  ⚠ Added a missing #!/bin/sh shebang: without it, git cannot execute this hook on Windows.'));
+      }
+      if (needsAppend) {
         console.log(chalk.green('  ✓ Adding uds check to pre-commit hook'));
-      } else {
+      } else if (!hadLegacyLine && !addedShebang) {
         console.log(chalk.gray('  ✓ Pre-commit hook already configured'));
       }
     } catch (e) {
       console.log(chalk.red(`  ✗ Failed to configure pre-commit hook: ${e.message}`));
     }
 
-    // 5. Say what we changed in their package.json.
+    // 5. Wire git so the hook ACTUALLY runs — this is the fix. Setting
+    // `core.hooksPath` ourselves is what husky's own bootstrap does internally
+    // (verified against husky ^9.1.7's source: `git config core.hooksPath
+    // <dir>/_`, plus a shim under `_/` forwarding to the real script); doing
+    // it directly means the check is live immediately after `uds init`,
+    // whether or not husky is installed or `npm install` ever runs again.
+    // Never overrides an adopter's own `core.hooksPath`, or an existing
+    // native `.git/hooks/pre-commit` (see wireGitHooksPath).
+    const wireResult = wireGitHooksPath(projectPath, '.husky');
+    if (wireResult.wired) {
+      console.log(chalk.green('  ✓ Pre-commit check is active for this clone (git core.hooksPath → .husky)'));
+    } else {
+      console.log(chalk.yellow(`  ⚠ Pre-commit check NOT enabled: ${wireResult.reason}`));
+      console.log(chalk.gray(`    ${wireResult.hint}`));
+    }
+    // `core.hooksPath` is LOCAL git config — it is never committed. This wiring
+    // only applies to this clone; `uds check` reports the gap for anyone who
+    // clones the repo without re-running this step (see
+    // checkPreCommitHookWiring in git-hooks.js / check.js).
+    console.log(chalk.gray('    Note: this is per-clone (git config is not committed) — teammates need to run `uds init` (or the fix above) in their own clone too.'));
+
+    // 6. Say what we changed in their package.json.
     if (pkgChanges.length > 0) {
       console.log(chalk.cyan('  package.json modified:'));
       for (const change of pkgChanges) {
@@ -452,13 +527,34 @@ export async function setupHuskyHook(projectPath, { allowInTest = false } = {})
     const hookDir = join(projectPath, '.git', 'hooks');
     const hookPath = join(hookDir, 'pre-commit');
 
+    // git's default hooks directory is `.git/hooks` — but only when
+    // `core.hooksPath` is unset. If the adopter (or another tool) already
+    // points it elsewhere, writing here would produce a file git never looks
+    // at, and `uds init` would report success for a check that never runs.
+    const configuredHooksPath = getLocalHooksPathConfig(projectPath);
+    if (configuredHooksPath) {
+      console.log(chalk.yellow(`  ⚠ Pre-commit check NOT enabled: git core.hooksPath is already set to "${configuredHooksPath}"`));
+      console.log(chalk.gray('    UDS writes to .git/hooks/pre-commit, but git will not look there while core.hooksPath points elsewhere.'));
+      console.log(chalk.gray(`    Add "uds check" to a pre-commit hook under "${configuredHooksPath}" yourself, or: git config --local --unset core.hooksPath`));
+      console.log();
+      return;
+    }
+
     try {
       if (!existsSync(hookDir)) {
         mkdirSync(hookDir, { recursive: true });
       }
 
-      if (existsSync(hookPath) && readFileSync(hookPath, 'utf-8').includes('uds check')) {
-        console.log(chalk.gray('  ✓ Pre-commit hook already configured'));
+      if (existsSync(hookPath)) {
+        const existingContent = readFileSync(hookPath, 'utf-8');
+        if (existingContent.includes('uds check')) {
+          console.log(chalk.gray('  ✓ Pre-commit hook already configured'));
+        } else {
+          // Never clobber an adopter's own hook (this fix — it used to be
+          // overwritten unconditionally here).
+          console.log(chalk.yellow('  ⚠ Pre-commit check NOT enabled: .git/hooks/pre-commit already exists'));
+          console.log(chalk.gray('    UDS will not overwrite it. Add "uds check" to it yourself, or remove it and re-run `uds init`.'));
+        }
       } else {
         const hookContent = `#!/bin/sh
 # UDS pre-commit hook

package/src/i18n/messages.js

@@ -872,6 +872,26 @@ export const messages = {
         commandsInstalledSuccess: 'Installed commands for {count} AI tools',
         // Read-only hint
         missingSkillsHint: 'Tip: Run `uds update` to install missing Skills/Commands',
+        // Pre-commit hook wiring (XSPEC: uds init writes a hook but never
+        // confirmed git would run it — this reports the gap, read-only)
+        hookNotWiredTitle: '⚠ [pre-commit] {file} was installed, but git will not run it.',
+        hookNotWiredOverride: '  git core.hooksPath is set to "{path}" — UDS will not override it. Confirm the hook there also runs `npx uds check`, or switch it yourself: git config --local core.hooksPath .husky',
+        hookNotWiredUnwired: '  git core.hooksPath is not set, and {file} is not on git\'s default hook path.',
+        hookNotWiredFix: '  Fix (per-clone — not committed, teammates must repeat it): git config --local core.hooksPath .husky',
+        hookNotWiredFixNative: '  Fix: point core.hooksPath back to the default (git config --local --unset core.hooksPath), or add `uds check` under "{path}" instead.',
+        // Order matters here: setting hooksPath BEFORE removing the `_/husky.sh`
+        // line makes git execute {file} directly and fail on that line — verified
+        // against a real adopter's exact legacy template, 2026-09-27. `uds init`
+        // will not fix this for an already-initialized project (it refuses to run
+        // at all once `.standards/` exists), so the fix must be self-contained here.
+        hookNotWiredFixLegacy: '  Fix, in this exact order — this file still sources `_/husky.sh` (husky v8 syntax), a directory that only exists after husky\'s own bootstrap has run: (1) delete the line `. "$(dirname -- "$0")/_/husky.sh"` from {file}; (2) then run: git config --local core.hooksPath .husky (per-clone — not committed, teammates must repeat it). Doing (2) alone makes every commit fail with an error that `_/husky.sh` cannot be found ("No such file or directory" on macOS, ".: cannot open" on Linux).',
+        hookNotWiredLegacyV8Fix: '  Also: {file} still sources `_/husky.sh` (husky v8 syntax) — delete that line too, or the fix above will make every commit fail with an error that `_/husky.sh` cannot be found ("No such file or directory" on macOS, ".: cannot open" on Linux).',
+        // Missing shebang: independent of wiring — POSIX git falls back to
+        // /bin/sh on ENOEXEC (a hook with no shebang), git for Windows does
+        // not, and fails every commit with "cannot spawn {file}: No such
+        // file or directory". Measured 2026-09-27 in CI (windows-latest).
+        hookMissingShebangTitle: '⚠ [pre-commit] {file} has no shebang line — git cannot run it on Windows.',
+        hookMissingShebangFix: '  Fix: add a `#!/bin/sh` shebang as the very first line of {file} (a husky-managed hook gets this automatically the next time `uds init` touches it), or re-run `uds init`.',
         // Summary mode (--summary)
         summary_mode: {
           title: 'UDS Status Summary',
@@ -2112,6 +2132,24 @@ export const messages = {
         commandsInstalledSuccess: '已為 {count} 個 AI 工具安裝斜線命令',
         // Read-only hint
         missingSkillsHint: '提示：執行 `uds update` 安裝缺少的 Skills/斜線命令',
+        // 提交前檢查是否真的會被 git 執行（uds init 寫了檢查檔，卻沒確認 git 會跑它——這裡只回報，不寫入）
+        hookNotWiredTitle: '⚠ [pre-commit] {file} 已安裝，但 git 實際不會執行它。',
+        hookNotWiredOverride: '  git core.hooksPath 已設定為「{path}」——UDS 不會覆蓋它。請確認該路徑下的檔案也會執行 `npx uds check`，或自行改用：git config --local core.hooksPath .husky',
+        hookNotWiredUnwired: '  git core.hooksPath 未設定，而 {file} 也不在 git 預設會讀取的路徑上。',
+        hookNotWiredFix: '  修復方式（僅對此 clone 生效，不會進版控，其他人 clone 後要自己再跑一次）：git config --local core.hooksPath .husky',
+        hookNotWiredFixNative: '  修復方式：把 core.hooksPath 改回預設（git config --local --unset core.hooksPath），或改在「{path}」底下也加上 `uds check`。',
+        // 順序不可顛倒：先設 hooksPath 再刪那一行，會讓 git 直接執行 {file} 並卡在
+        // `_/husky.sh` 那一行（2026-09-26 已在真實採用者的舊範本上實測到）。
+        // `uds init` 對已初始化的專案會直接拒絕執行，修不了這個，所以這裡要給
+        // 一次就講完整、不需要再跑任何指令的修法。
+        hookNotWiredFixLegacy: '  修復方式，順序不可顛倒——這個檔案還留著 `_/husky.sh`（husky v8 舊語法），它 source 的目錄只有在 husky 自己的 bootstrap 跑過後才存在：(1) 先刪掉 {file} 裡的這一行：`. "$(dirname -- "$0")/_/husky.sh"`；(2) 再執行：git config --local core.hooksPath .husky（僅對此 clone 生效，不會進版控，其他人要自己再做一次）。只做 (2) 不做 (1) 會讓每一次提交都失敗，印出找不到 `_/husky.sh` 的錯誤（macOS 為「No such file or directory」、Linux 為「.: cannot open」）。',
+        hookNotWiredLegacyV8Fix: '  另外：{file} 還留著 `_/husky.sh`（husky v8 舊語法）——這一行也要刪掉，不然上面的修復方式會讓每一次提交都失敗，印出找不到 `_/husky.sh` 的錯誤（macOS 為「No such file or directory」、Linux 為「.: cannot open」）。',
+        // 缺少 shebang：與 wiring 無關——POSIX git 在 ENOEXEC（hook 沒有 shebang）
+        // 時會退回用 /bin/sh 執行，git for Windows 沒有這個後備機制，每次提交
+        // 都會失敗，訊息是「cannot spawn {file}: No such file or directory」。
+        // 2026-09-27 於 CI（windows-latest）實測。
+        hookMissingShebangTitle: '⚠ [pre-commit] {file} 沒有 shebang 行——在 Windows 上 git 無法執行它。',
+        hookMissingShebangFix: '  修復方式：在 {file} 的第一行加上 shebang `#!/bin/sh`（由 husky 管理的 hook，下次 `uds init` 動到它時會自動處理），或重新執行 `uds init`。',
         // Summary mode (--summary)
         summary_mode: {
           title: 'UDS 狀態摘要',
@@ -3364,6 +3402,20 @@ export const messages = {
         commandsInstalledSuccess: '已为 {count} 个 AI 工具安装斜线命令',
         // Read-only hint
         missingSkillsHint: '提示：执行 `uds update` 安装缺少的 Skills/斜线命令',
+        // 提交前检查是否真的会被 git 执行（uds init 写了检查文件，却没确认 git 会跑它——这里只回报，不写入）
+        hookNotWiredTitle: '⚠ [pre-commit] {file} 已安装，但 git 实际不会执行它。',
+        hookNotWiredOverride: '  git core.hooksPath 已设定为“{path}”——UDS 不会覆盖它。请确认该路径下的文件也会执行 `npx uds check`，或自行改用：git config --local core.hooksPath .husky',
+        hookNotWiredUnwired: '  git core.hooksPath 未设定，而 {file} 也不在 git 默认会读取的路径上。',
+        hookNotWiredFix: '  修复方式（仅对此 clone 生效，不会进版控，其他人 clone 后要自己再跑一次）：git config --local core.hooksPath .husky',
+        hookNotWiredFixNative: '  修复方式：把 core.hooksPath 改回默认（git config --local --unset core.hooksPath），或改在“{path}”下也加上 `uds check`。',
+        hookNotWiredFixLegacy: '  修复方式，顺序不可颠倒——这个文件还留着 `_/husky.sh`（husky v8 旧语法），它 source 的目录只有在 husky 自己的 bootstrap 跑过后才存在：(1) 先删掉 {file} 里的这一行：`. "$(dirname -- "$0")/_/husky.sh"`；(2) 再执行：git config --local core.hooksPath .husky（仅对此 clone 生效，不会进版控，其他人要自己再做一次）。只做 (2) 不做 (1) 会让每一次提交都失败，打印找不到 `_/husky.sh` 的错误（macOS 为“No such file or directory”、Linux 为“.: cannot open”）。',
+        hookNotWiredLegacyV8Fix: '  另外：{file} 还留着 `_/husky.sh`（husky v8 旧语法）——这一行也要删掉，不然上面的修复方式会让每一次提交都失败，打印找不到 `_/husky.sh` 的错误（macOS 为“No such file or directory”、Linux 为“.: cannot open”）。',
+        // 缺少 shebang：与 wiring 无关——POSIX git 在 ENOEXEC（hook 没有 shebang）
+        // 时会回退用 /bin/sh 执行，git for Windows 没有这个后备机制，每次提交
+        // 都会失败，消息是“cannot spawn {file}: No such file or directory”。
+        // 2026-09-27 于 CI（windows-latest）实测。
+        hookMissingShebangTitle: '⚠ [pre-commit] {file} 没有 shebang 行——在 Windows 上 git 无法执行它。',
+        hookMissingShebangFix: '  修复方式：在 {file} 的第一行加上 shebang `#!/bin/sh`（由 husky 管理的 hook，下次 `uds init` 动到它时会自动处理），或重新运行 `uds init`。',
         // Summary mode (--summary)
         summary_mode: {
           title: 'UDS 状态摘要',

package/src/utils/git-hooks.js

@@ -0,0 +1,282 @@
+/**
+ * Git pre-commit hook wiring — shared by `uds init` (writer, see
+ * setupHuskyHook in ../commands/init.js) and `uds check` (read-only
+ * detector, see checkPreCommitHookWiring in ../commands/check.js).
+ *
+ * Origin: `uds init` writes `.husky/pre-commit`, but never made git actually
+ * run it. It relied on husky's own bootstrap (`npm install` triggering the
+ * `prepare` script, which husky uses to set `core.hooksPath`), which only
+ * fires the NEXT time `npm install` runs — never, if the adopter's
+ * `node_modules` already existed. Verified 2026-09-26 against three real
+ * adopters (asiaostrich-telemetry-server, asiaostrich-telemetry-client,
+ * machine-setup): all three have `.husky/pre-commit` calling `npx uds check`,
+ * none has `core.hooksPath` set, and the hook has never once run.
+ *
+ * Fix: set `core.hooksPath` directly ourselves. This is exactly what husky's
+ * own `index.js` does internally (verified against husky ^9.1.7's source:
+ * `git config core.hooksPath ${dir}/_`, then a shim under `_/` that execs the
+ * real script one directory up) — we do the equivalent for `.husky` directly
+ * so the hook is live immediately after `uds init`, independent of whether
+ * husky is installed or `npm install` ever runs again.
+ */
+import { existsSync, readFileSync } from 'fs';
+import { execSync } from 'child_process';
+import { join, dirname, basename, isAbsolute } from 'path';
+
+/** Read `core.hooksPath` from LOCAL git config only (never global/system) — the
+ * scope we write to, and the only one that could conflict with what we set.
+ * @returns {string|null} the configured value, or null if unset
+ */
+export function getLocalHooksPathConfig(projectPath) {
+  try {
+    const out = execSync('git config --local --get core.hooksPath', {
+      cwd: projectPath,
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe']
+    }).trim();
+    return out || null;
+  } catch {
+    // `git config --get` exits 1 when the key is unset — that is not an error.
+    return null;
+  }
+}
+
+/**
+ * The hooks directory git will ACTUALLY use right now, honoring `core.hooksPath`
+ * (local, global or system — whichever git resolves) and falling back to
+ * `.git/hooks` when unset. This is `git rev-parse --git-path hooks`, chosen
+ * over reading `core.hooksPath` ourselves because it matches what git itself
+ * resolves, including the worktree/`.git`-is-a-file case.
+ * @returns {string|null} absolute path, or null if it could not be determined
+ *   (e.g. not a git repository, or git is not on PATH) — callers must treat
+ *   that as "unknown", never as "unwired".
+ */
+export function getEffectiveHooksDir(projectPath) {
+  try {
+    const out = execSync('git rev-parse --git-path hooks', {
+      cwd: projectPath,
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe']
+    }).trim();
+    if (!out) return null;
+    return isAbsolute(out) ? out : join(projectPath, out);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Point git's hook directory at `targetRelDir` (e.g. `.husky`) so a
+ * pre-commit hook UDS writes there actually runs — without depending on
+ * husky (or any npm install) ever executing.
+ *
+ * Never overrides:
+ *   - an adopter's own `core.hooksPath` pointed anywhere else — we do not
+ *     know what they use it for, and clobbering it could break hooks for
+ *     every event, not just pre-commit.
+ *   - an existing native `.git/hooks/pre-commit`, when `core.hooksPath` is
+ *     unset (git's default is `.git/hooks`) — setting `core.hooksPath` in
+ *     that case would silently stop git from ever running that file again.
+ *
+ * @param {string} projectPath
+ * @param {string} targetRelDir - relative to projectPath, e.g. '.husky'
+ * @returns {{wired: boolean, reason?: string, hint?: string}}
+ */
+export function wireGitHooksPath(projectPath, targetRelDir) {
+  const targetAbs = join(projectPath, targetRelDir);
+  const configured = getLocalHooksPathConfig(projectPath);
+
+  if (configured) {
+    const configuredAbs = isAbsolute(configured) ? configured : join(projectPath, configured);
+    if (configuredAbs === targetAbs) {
+      return { wired: true };
+    }
+    return {
+      wired: false,
+      reason: `git core.hooksPath is already set to "${configured}"`,
+      hint: `UDS will not override an existing core.hooksPath. Confirm the hook script there also runs \`npx uds check\`, or switch it yourself: git config --local core.hooksPath ${targetRelDir}`
+    };
+  }
+
+  // Unset → git's default is `.git/hooks`. An existing hook there is the
+  // adopter's own (or from a tool that writes it directly, not via
+  // core.hooksPath); switching hooksPath now would silently stop git from
+  // ever running it again.
+  const nativeHookPath = join(projectPath, '.git', 'hooks', 'pre-commit');
+  if (existsSync(nativeHookPath)) {
+    return {
+      wired: false,
+      reason: '.git/hooks/pre-commit already exists',
+      hint: 'UDS will not overwrite or bypass an existing .git/hooks/pre-commit. Add "npx uds check" to it manually, or remove it and re-run `uds init`.'
+    };
+  }
+
+  try {
+    execSync(`git config --local core.hooksPath ${targetRelDir}`, {
+      cwd: projectPath,
+      stdio: ['pipe', 'pipe', 'pipe']
+    });
+    return { wired: true };
+  } catch (e) {
+    return {
+      wired: false,
+      reason: `could not set git core.hooksPath (${e.message})`,
+      hint: `Run manually: git config --local core.hooksPath ${targetRelDir}`
+    };
+  }
+}
+
+/** Does `filePath` contain the marker UDS writes into a hook it manages? */
+function hasUdsMarker(filePath) {
+  try {
+    return readFileSync(filePath, 'utf-8').includes('uds check');
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Does `content` begin with a shebang line (`#!...`)?
+ *
+ * Why this matters on Windows and nowhere else: POSIX git, on ENOEXEC (a
+ * script with no shebang), silently retries the exec via `/bin/sh` — that
+ * fallback is why a husky v9 hook with no shebang has always worked on macOS
+ * and Linux. Git for Windows has no such fallback: without a shebang line it
+ * cannot resolve an interpreter at all, and fails EVERY commit with
+ * `error: cannot spawn <hookfile>: No such file or directory` — the exact
+ * message measured 2026-09-27 in CI (windows-latest) for both a husky hook
+ * (which has never carried a shebang) and a `.git/hooks/pre-commit` test
+ * fixture that also happened to lack one; a sibling fixture carrying
+ * `#!/bin/sh` executed correctly. The message names the hook file, not the
+ * missing interpreter, which is why this was first mistaken for a wiring
+ * problem rather than a content problem.
+ */
+export function hasShebang(content) {
+  return typeof content === 'string' && content.startsWith('#!');
+}
+
+/**
+ * Prepend `#!/bin/sh` when `content` has no shebang; a no-op otherwise. Never
+ * touches an existing shebang (an adopter may already declare bash or another
+ * interpreter) and never rewrites any other line — pairs with
+ * stripLegacyHuskyShLine below, which makes the same promise for the v8
+ * sourcing line.
+ * @returns {{content: string, added: boolean}}
+ */
+export function ensureShebang(content) {
+  if (hasShebang(content)) return { content, added: false };
+  return { content: `#!/bin/sh\n${content}`, added: true };
+}
+
+/**
+ * husky v8's `_/husky.sh` sourcing line — the exact shape husky itself
+ * generated before v9 (`. "$(dirname -- "$0")/_/husky.sh"`, with minor
+ * `dirname` argument variations). The directory it sources (`.husky/_/`)
+ * only exists after husky's OWN bootstrap has actually run; once git
+ * executes the hook file directly — which `wireGitHooksPath` above makes it
+ * do, by pointing `core.hooksPath` straight at `.husky` instead of at
+ * husky's shim — a hook still carrying this line fails on EVERY commit with
+ * "No such file or directory", worse than the original defect. Verified
+ * against a real adopter's exact legacy template after following the
+ * hooksPath-only advice this module used to give (2026-09-27).
+ *
+ * Shared by the detector (checkPreCommitHookWiring, below) and the writer
+ * (setupHuskyHook's rewrite step, init.js) so they can never disagree on
+ * what counts as this line.
+ */
+export const LEGACY_HUSKY_SH_LINE = /^\s*(\.|source)\s+.*_\/husky\.sh["']?\s*$/;
+
+/** Does `content` contain husky v8's `_/husky.sh` sourcing line? */
+export function hasLegacyHuskyShLine(content) {
+  return content.split('\n').some((line) => LEGACY_HUSKY_SH_LINE.test(line));
+}
+
+/**
+ * Remove husky v8's `_/husky.sh` sourcing line from `content`, if present.
+ * Everything else — the adopter's own commands, an existing `uds check`
+ * line, a shebang — is left exactly as it was, in its original order.
+ * @returns {{content: string, removed: boolean}}
+ */
+export function stripLegacyHuskyShLine(content) {
+  const lines = content.split('\n');
+  const kept = lines.filter((line) => !LEGACY_HUSKY_SH_LINE.test(line));
+  return { content: kept.join('\n'), removed: kept.length !== lines.length };
+}
+
+/**
+ * Read-only detector for `uds check`: a UDS-managed pre-commit hook file
+ * exists, but is it actually on git's execution path?
+ *
+ * Handles three wiring shapes as "wired":
+ *   1. Direct — `core.hooksPath` points straight at the UDS-managed file's
+ *      directory (what `wireGitHooksPath` above sets up).
+ *   2. husky's own bootstrap — `core.hooksPath` points at `<dir>/_` (a shim
+ *      directory husky itself creates via `npx husky`/the `prepare` script);
+ *      the shim at `<dir>/_/pre-commit` forwards to `<dir>/pre-commit`, the
+ *      UDS-managed file, one directory up.
+ *   3. Non-Node native install — `.git/hooks/pre-commit` IS the UDS-managed
+ *      file, and `core.hooksPath` is unset (git's default).
+ *
+ * Also reports `missingShebang`, independent of `wired`: a hook file that
+ * IS on git's execution path can still fail every commit on Windows if it
+ * has no `#!` line (see hasShebang above) — a portability defect, not a
+ * wiring defect, so it is surfaced even when `wired: true`.
+ *
+ * @param {string} projectPath
+ * @returns {{relevant: boolean, wired?: boolean, hookFile?: string,
+ *   configuredHooksPath?: string|null, effectiveHooksDir?: string|null,
+ *   legacyV8?: boolean, missingShebang?: boolean}}
+ *   `relevant: false` means there is nothing UDS-managed to report on (no
+ *   hook file, or hooks-dir could not be determined — never guess "unwired"
+ *   from a failed lookup).
+ */
+export function checkPreCommitHookWiring(projectPath) {
+  if (!existsSync(join(projectPath, '.git'))) return { relevant: false };
+
+  const huskyHookPath = join(projectPath, '.husky', 'pre-commit');
+  const nativeHookPath = join(projectPath, '.git', 'hooks', 'pre-commit');
+  const hasHuskyHook = existsSync(huskyHookPath) && hasUdsMarker(huskyHookPath);
+  const hasNativeHook = existsSync(nativeHookPath) && hasUdsMarker(nativeHookPath);
+
+  if (!hasHuskyHook && !hasNativeHook) return { relevant: false };
+
+  const effectiveHooksDir = getEffectiveHooksDir(projectPath);
+  if (!effectiveHooksDir) return { relevant: false }; // can't determine — do not guess
+
+  // The UDS-managed source file — not the resolved effectiveFile below, which
+  // for husky's shim shape (case 2) is a forwarding script we do not own —
+  // is the one whose first line actually decides whether Windows can spawn it.
+  const hookFile = hasHuskyHook ? '.husky/pre-commit' : '.git/hooks/pre-commit';
+  const managedPath = hasHuskyHook ? huskyHookPath : nativeHookPath;
+  const missingShebang = (() => {
+    try { return !hasShebang(readFileSync(managedPath, 'utf-8')); } catch { return false; }
+  })();
+
+  const effectiveFile = join(effectiveHooksDir, 'pre-commit');
+  let wired = false;
+  if (existsSync(effectiveFile)) {
+    if (hasUdsMarker(effectiveFile)) {
+      wired = true;
+    } else if (basename(effectiveHooksDir) === '_') {
+      // husky-style shim dir: the real script lives one directory up.
+      const delegated = join(dirname(effectiveHooksDir), 'pre-commit');
+      wired = existsSync(delegated) && hasUdsMarker(delegated);
+    }
+  }
+
+  if (wired) return { relevant: true, wired: true, hookFile, missingShebang };
+
+  const legacyV8 = hasHuskyHook && (() => {
+    try { return hasLegacyHuskyShLine(readFileSync(huskyHookPath, 'utf-8')); } catch { return false; }
+  })();
+
+  return {
+    relevant: true,
+    wired: false,
+    hookFile,
+    configuredHooksPath: getLocalHooksPathConfig(projectPath),
+    effectiveHooksDir,
+    legacyV8,
+    missingShebang
+  };
+}

package/standards-registry.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "6.13.0-beta.2",
+  "version": "6.13.0-beta.4",
   "lastUpdated": "2026-05-13",
   "description": "Standards registry for universal-dev-standards with integrated skills and AI-optimized formats",
   "formats": {
@@ -58,14 +58,14 @@
     "standards": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
-      "version": "6.13.0-beta.2"
+      "version": "6.13.0-beta.4"
     },
     "skills": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
       "localPath": "skills",
       "rawUrl": "https://raw.githubusercontent.com/AsiaOstrich/universal-dev-standards/main/skills",
-      "version": "6.13.0-beta.2",
+      "version": "6.13.0-beta.4",
       "note": "Skills are now included in the main repository under skills/"
     }
   },
@@ -2295,7 +2295,7 @@
       "id": "license-compliance",
       "name": "License Compliance Standards",
       "nameZh": "授權合規標準",
-      "version": "6.13.0-beta.2",
+      "version": "6.13.0-beta.4",
       "source": {
         "human": "core/license-compliance.md",
         "ai": "ai/standards/license-compliance.ai.yaml"
@@ -2307,7 +2307,7 @@
       "id": "verification-oracle",
       "name": "Verification Oracle Standards",
       "nameZh": "驗證 Oracle 標準",
-      "version": "6.13.0-beta.2",
+      "version": "6.13.0-beta.4",
       "source": {
         "human": "core/verification-oracle.md",
         "ai": "ai/standards/verification-oracle.ai.yaml"
@@ -2319,7 +2319,7 @@
       "id": "model-provenance",
       "name": "Model Provenance Policy Standards",
       "nameZh": "模型來源政策標準",
-      "version": "6.13.0-beta.2",
+      "version": "6.13.0-beta.4",
       "source": {
         "human": "core/model-provenance.md",
         "ai": "ai/standards/model-provenance.ai.yaml"
@@ -2331,7 +2331,7 @@
       "id": "resource-cost-boundary",
       "name": "Resource / Cost Boundary Declaration Standards",
       "nameZh": "資源／成本邊界宣告標準",
-      "version": "6.13.0-beta.2",
+      "version": "6.13.0-beta.4",
       "source": {
         "human": "core/resource-cost-boundary.md",
         "ai": "ai/standards/resource-cost-boundary.ai.yaml"