universal-dev-standards 6.14.0-beta.2 → 6.14.0-beta.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (53) hide show
  1. package/bundled/ai/standards/ai-response-navigation.ai.yaml +43 -3
  2. package/bundled/ai/standards/checkin-standards.ai.yaml +25 -6
  3. package/bundled/ai/standards/open-work-tracking.ai.yaml +4 -1
  4. package/bundled/ai/standards/pipeline-security-gates.ai.yaml +5 -1
  5. package/bundled/core/ai-response-navigation.md +128 -12
  6. package/bundled/core/open-work-tracking.md +1 -1
  7. package/bundled/extensions/frameworks/fat-free-patterns.md +937 -0
  8. package/bundled/extensions/languages/csharp-style.md +464 -0
  9. package/bundled/extensions/languages/php/fat-free-patterns.md +915 -0
  10. package/bundled/extensions/languages/php/php-style.md +693 -0
  11. package/bundled/extensions/languages/php-style.md +700 -0
  12. package/bundled/extensions/locales/zh-cn.md +717 -0
  13. package/bundled/extensions/locales/zh-tw.md +717 -0
  14. package/bundled/locales/COVERAGE.md +5 -4
  15. package/bundled/locales/zh-CN/CHANGELOG.md +44 -3
  16. package/bundled/locales/zh-CN/README.md +2 -2
  17. package/bundled/locales/zh-CN/SECURITY.md +1 -1
  18. package/bundled/locales/zh-CN/core/ai-response-navigation.md +110 -12
  19. package/bundled/locales/zh-CN/skills/README.md +1 -0
  20. package/bundled/locales/zh-CN/skills/comprehension-ladder/SKILL.md +289 -0
  21. package/bundled/locales/zh-CN/skills/comprehension-ladder/eval-cases.md +261 -0
  22. package/bundled/locales/zh-TW/CHANGELOG.md +44 -3
  23. package/bundled/locales/zh-TW/README.md +2 -2
  24. package/bundled/locales/zh-TW/SECURITY.md +1 -1
  25. package/bundled/locales/zh-TW/core/ai-response-navigation.md +110 -12
  26. package/bundled/locales/zh-TW/core/open-work-tracking.md +3 -3
  27. package/bundled/locales/zh-TW/skills/README.md +1 -0
  28. package/bundled/locales/zh-TW/skills/comprehension-ladder/SKILL.md +289 -0
  29. package/bundled/locales/zh-TW/skills/comprehension-ladder/eval-cases.md +261 -0
  30. package/bundled/skills/README.md +1 -0
  31. package/bundled/skills/comprehension-ladder/SKILL.md +283 -0
  32. package/bundled/skills/comprehension-ladder/eval-cases.md +255 -0
  33. package/package.json +2 -2
  34. package/src/commands/check.js +9 -0
  35. package/src/commands/init.js +100 -27
  36. package/src/commands/uninstall.js +144 -30
  37. package/src/commands/update.js +62 -3
  38. package/src/core/install-records.js +191 -0
  39. package/src/i18n/messages.js +39 -6
  40. package/src/installers/hooks-installer.js +61 -30
  41. package/src/installers/integration-installer.js +5 -1
  42. package/src/installers/standards-installer.js +16 -23
  43. package/src/reconciler/plan-executor.js +10 -11
  44. package/src/uninstallers/hook-uninstaller.js +219 -33
  45. package/src/uninstallers/integration-uninstaller.js +35 -5
  46. package/src/utils/copier.js +57 -0
  47. package/src/utils/git-hooks.js +139 -7
  48. package/src/utils/hasher.js +36 -0
  49. package/src/utils/integration-generator.js +16 -6
  50. package/src/utils/legacy-hook-migration.js +112 -0
  51. package/src/utils/locale.js +19 -0
  52. package/src/utils/open-work-tracking.mjs +124 -23
  53. package/standards-registry.json +21 -7
@@ -0,0 +1,283 @@
1
+ ---
2
+ name: comprehend
3
+ scope: universal
4
+ description: |
5
+ [UDS] Turn one hard-to-follow AI output into easier forms: controlled text, a Mermaid diagram, a single-file HTML explainer. All forms come from one shared outline, so the form changes and the facts do not.
6
+ Use when: an AI explanation, spec or code walk-through is too dense to judge, a non-specialist must approve something from it, you want a diagram or an offline explainer page of it.
7
+ Not for: writing new content or adding analysis — this skill only re-forms a text that exists; generating docs from source code — use /docgen; shortening a text for an expert reader — edit it directly.
8
+ Keywords: comprehension ladder, explainer, controlled language, Mermaid, HTML explainer, outline, plain language, understand AI output, 理解階梯, 受控語言, 流程圖, 解說頁, 換形式不換事實.
9
+ allowed-tools: Read, Glob, Grep, Write
10
+ argument-hint: "[text or file | 原文或檔案] [rungs: 1 | 2 | 3]"
11
+ ---
12
+
13
+ # Comprehension Ladder | 理解階梯
14
+
15
+ > **Language**: English | [繁體中文](../../locales/zh-TW/skills/comprehension-ladder/SKILL.md) | [简体中文](../../locales/zh-CN/skills/comprehension-ladder/SKILL.md)
16
+
17
+ **Version**: 1.0.0 | **Last Updated**: 2026-10-05 | **Applicability**: Claude Code Skills
18
+
19
+ Turn one AI output that is hard to follow into forms that are easier to follow. The form changes. The facts do not.
20
+
21
+ ## Purpose
22
+
23
+ The slow step is no longer getting an answer. The slow step is understanding the answer and judging it. This skill helps with that step. It takes one source text and builds up to three forms of it, called rungs.
24
+
25
+ This skill is written in controlled language, as described in [ai-response-navigation](../../core/ai-response-navigation.md) Rule 12. It follows its own guards.
26
+
27
+ ## The ladder
28
+
29
+ There are exactly three rungs. Each rung is built from the same outline (see [The outline](#the-outline)). No rung adds anything to the outline.
30
+
31
+ | Rung | Form | Best for | Output |
32
+ |------|------|----------|--------|
33
+ | 1 | Controlled text | Any source. Always the first rung. | Short sentences or numbered lines, in the chat or a file |
34
+ | 2 | Mermaid diagram | A source with a flow, a time order, several parties, or 3 or more options | One Mermaid code block, plus a text list of items that cannot be drawn |
35
+ | 3 | Single-file HTML explainer | A reader who must explore or approve | One `.html` file that opens offline |
36
+
37
+ Ask which rungs the user wants. If the user does not say, build rung 1 and offer the other two.
38
+
39
+ There is no video rung. Video needs a voice service, and it sends the source to a third party.
40
+
41
+ ## The three guards
42
+
43
+ These three guards are **Required**. A rung that breaks one is not finished. Do not deliver it.
44
+
45
+ | ID | Guard | Priority |
46
+ |----|-------|----------|
47
+ | G1 | `no-new-facts`: add no fact the source does not state | **Required** |
48
+ | G2 | `keep-hedges`: keep every hedge. Do not turn an uncertain claim into a certain one | **Required** |
49
+ | G3 | `trace-and-gaps`: give every item a source pointer and a "not covered" note | **Required** |
50
+
51
+ G2 is the same rule as clause 12.1 in [ai-response-navigation](../../core/ai-response-navigation.md). The wording here is applied to this skill's three rungs.
52
+
53
+ ### G1 `no-new-facts` (Required)
54
+
55
+ Every claim in every rung must come from the source. Do not add a cause, a number, a name, a date or a "confirmed". Do not add background that you know but the source does not say.
56
+
57
+ **Good** — the source says: "Orders sometimes fail at the payment step."
58
+
59
+ ```text
60
+ O1 Orders sometimes fail at the payment step.
61
+ ```
62
+
63
+ **Bad** — the same source:
64
+
65
+ ```text
66
+ O1 Orders fail at the payment step. This also breaks refunds.
67
+ ```
68
+
69
+ The word "refunds" is a new fact. The word "sometimes" is gone as well, so G2 is broken too.
70
+
71
+ ### G2 `keep-hedges` (Required)
72
+
73
+ A hedge tells the reader how far to trust a claim. Examples: might, could, probably, appears to, not yet confirmed, 可能, 推斷, 尚未確認. A hedge is information, not padding.
74
+
75
+ - If the source says "might", the rung says "might".
76
+ - Keep the hedge in the diagram too. Draw a hedged item with a dashed edge and keep the hedge word in its label.
77
+ - Keep the hedge in the HTML too. Show a visible "not confirmed" badge on the item.
78
+ - A hedge may go only when the source itself says the claim is now verified. Then state what was checked.
79
+
80
+ **Good** — the source says: "The cause might be a cache that holds an old price list."
81
+
82
+ ```text
83
+ O2 The cause might be a cache that holds an old price list. [hedge: might]
84
+ ```
85
+
86
+ **Bad** — the same source:
87
+
88
+ ```text
89
+ O2 The cause is a cache that holds an old price list.
90
+ ```
91
+
92
+ The bad version is shorter and easier to read. It is also untrue to the source. A reader who approves a fix on this line has been misled.
93
+
94
+ ### G3 `trace-and-gaps` (Required)
95
+
96
+ Every item carries two notes:
97
+
98
+ - **Source**: the place in the source where the item comes from. Use a paragraph and sentence number, or a file and line number, plus a quote of 12 words or fewer.
99
+ - **Not covered**: what the item leaves out, or what it cannot prove. If the source says nothing more, write "Nothing further in the source."
100
+
101
+ After the last item, add one list called **Left out of this outline**. It names every part of the source that became no item.
102
+
103
+ **Good**
104
+
105
+ ```text
106
+ O3 We have not yet reproduced this in staging.
107
+ Source: paragraph 1, sentence 3 — "not yet reproduced this in staging"
108
+ Not covered: Why it was not reproduced. The source gives no reason.
109
+ ```
110
+
111
+ **Bad**
112
+
113
+ ```text
114
+ O3 The problem was reproduced in staging.
115
+ Source: the report.
116
+ ```
117
+
118
+ "The report" does not point to a place. The claim also reverses the source. There is no "not covered" note.
119
+
120
+ ## The outline
121
+
122
+ The outline is the one shared source of truth. Build it before any rung. Never write a rung from the source directly.
123
+
124
+ Each outline item has one id and one kind.
125
+
126
+ | Kind | Meaning |
127
+ |------|---------|
128
+ | `claim` | A statement the source makes |
129
+ | `mechanism` | A step, a cause, or a link between two things |
130
+ | `uncertainty` | Something the source says is unknown or unconfirmed |
131
+ | `example` | A case the source gives to show a claim |
132
+
133
+ Write each item in this shape:
134
+
135
+ ```text
136
+ O<number> | kind | text | hedge: <exact hedge words, or none>
137
+ Source: <pointer> — "<quote, 12 words or fewer>"
138
+ Not covered: <what the item leaves out>
139
+ ```
140
+
141
+ Number the items in the order of the source. Never reuse a number. All three rungs use the same ids.
142
+
143
+ ## Workflow
144
+
145
+ ### Step 1 — Read the source
146
+
147
+ Read the whole source. If the source is a file, read the file. Do not start the outline before you finish reading.
148
+
149
+ ### Step 2 — Build the outline
150
+
151
+ Extract the items. One fact per item. Copy each hedge word exactly.
152
+
153
+ ### Step 3 — Trace every item
154
+
155
+ Write the Source and Not covered notes for every item. Then write the **Left out of this outline** list.
156
+
157
+ ### Step 4 — Show the outline to the user
158
+
159
+ Show the outline when it has more than 5 items, or when the user asks. Let the user remove or correct items. Do not render a rung from an outline the user has rejected.
160
+
161
+ ### Step 5 — Render the rungs
162
+
163
+ Render each rung the user asked for. Follow the rules below for that rung.
164
+
165
+ #### Rung 1: controlled text
166
+
167
+ Follow [ai-response-navigation](../../core/ai-response-navigation.md) clause 12.2:
168
+
169
+ - One idea per sentence. About 15 to 25 words in English, or about 25 to 40 characters in Chinese.
170
+ - One name per thing. Do not vary a name for style.
171
+ - Name who does what.
172
+ - One step, one action. Put a procedure in a numbered list.
173
+ - Use few semicolons.
174
+ - Put units on numbers.
175
+
176
+ Keep the item id at the start of each line, so the reader can find the item in the outline.
177
+
178
+ #### Rung 2: Mermaid diagram
179
+
180
+ 1. Pick `flowchart TD` for steps and causes. Pick `flowchart LR` for parties and hand-offs.
181
+ 2. Draw one node for each `mechanism` item. Use the item id as the node id.
182
+ 3. Take the node label from the item text. Keep the hedge word in the label.
183
+ 4. Draw a hedged item as a dashed node or a dashed edge (`-.->`).
184
+ 5. Do not draw a node that has no outline id.
185
+ 6. List every item you did not draw, under the diagram, as text. Give each one a reason.
186
+
187
+ ```mermaid
188
+ flowchart TD
189
+ O1["O1 Orders sometimes fail at payment"]
190
+ O2["O2 might: a cache holds an old price list"]
191
+ O1 -.-> O2
192
+ ```
193
+
194
+ #### Rung 3: single-file HTML explainer
195
+
196
+ The page must be one file. It must open offline. It must not load anything from the network.
197
+
198
+ **Required** for the page:
199
+
200
+ - All CSS is inside one `<style>` element.
201
+ - All script, if any, is inside one inline `<script>` element. The page must work with script turned off.
202
+ - No `http://`, `https://` or `//` URL in `src`, `href`, `action`, `@import` or `url()`. The only links allowed are `#` anchors inside the page.
203
+ - No `<link>` element. No web font. No CDN. No external image.
204
+ - No `fetch`, `XMLHttpRequest`, `WebSocket` or `import()` call.
205
+ - Do not load the Mermaid library. Draw the diagram as inline SVG or as a styled list.
206
+ - Escape every character of the source text that HTML treats as markup.
207
+
208
+ The page holds, in this order:
209
+
210
+ 1. A title and one sentence that says what the source is.
211
+ 2. The diagram, if rung 2 was asked for.
212
+ 3. One card for each outline item. Each card shows the id, the text, a "not confirmed" badge if the item has a hedge, the Source, and the Not covered note.
213
+ 4. The **Left out of this outline** list.
214
+
215
+ A minimal skeleton:
216
+
217
+ ```html
218
+ <!doctype html>
219
+ <html lang="en">
220
+ <head>
221
+ <meta charset="utf-8">
222
+ <meta name="viewport" content="width=device-width, initial-scale=1">
223
+ <title>Explainer: short name of the source</title>
224
+ <style>
225
+ body { font: 16px/1.6 system-ui, sans-serif; max-width: 46rem; margin: 2rem auto; padding: 0 1rem; }
226
+ .card { border: 1px solid #8884; border-radius: 8px; padding: .75rem 1rem; margin: .75rem 0; }
227
+ .badge { background: #fd0; color: #000; border-radius: 4px; padding: 0 .4rem; font-size: .85em; }
228
+ </style>
229
+ </head>
230
+ <body>
231
+ <h1>Explainer</h1>
232
+ <p>One sentence: what the source is.</p>
233
+ <section class="card" id="O2">
234
+ <strong>O2</strong> The cause might be a cache that holds an old price list.
235
+ <span class="badge">not confirmed: might</span>
236
+ <p><em>Source:</em> paragraph 1, sentence 2</p>
237
+ <p><em>Not covered:</em> Which cache. The source does not say.</p>
238
+ </section>
239
+ </body>
240
+ </html>
241
+ ```
242
+
243
+ ### Step 6 — Check before you deliver
244
+
245
+ Run all five checks. Fix the rung and run them again if one fails.
246
+
247
+ 1. **Count**: the items in each rung equal the items in the outline, minus the items you listed as not drawn. A source with 5 steps gives 5 steps in every rung. Not 4. Not 6.
248
+ 2. **No new item**: every item in a rung has an outline id. Look for an item without one.
249
+ 3. **Hedge compare**: for each item with `hedge:` not `none`, the same hedge word is in every rung. The comparison is between the rung and the source. It works in any language.
250
+ 4. **Trace**: every item has a Source that points to a place and a Not covered note.
251
+ 5. **Offline** (rung 3 only): search the file for `http`, `//`, `<link`, `fetch(` and `XMLHttpRequest`. Each search must find nothing outside the text you quoted from the source.
252
+
253
+ ### Step 7 — Report
254
+
255
+ End with this table. Never deliver a rung without it.
256
+
257
+ | Item | Rung 1 | Rung 2 | Rung 3 | Hedge kept | Source | Not covered |
258
+ |------|--------|--------|--------|------------|--------|-------------|
259
+ | O1 | yes | yes | yes | n/a | para 1, s1 | The frequency of "sometimes" |
260
+
261
+ If any guard check failed and you could not fix it, say which one and why. Do not report success.
262
+
263
+ ## When not to use this skill
264
+
265
+ - The source has fewer than about 150 words. Rewrite it with [ai-response-navigation](../../core/ai-response-navigation.md) clause 12.2 and keep the hedges. Do not build rungs.
266
+ - The reader is an expert and needs the dense form.
267
+ - The task is to find new facts. This skill never does that.
268
+
269
+ ## Measuring whether it helps
270
+
271
+ This skill is not proven to help. [eval-cases.md](eval-cases.md) holds 5 source texts, each with comprehension questions and an answer key, and a procedure that gives two numbers: the correct-answer rate before and after, and the number of guard violations. The run needs model calls and has not been done. Do not claim that this skill works until it is done.
272
+
273
+ ## Related
274
+
275
+ - [ai-response-navigation](../../core/ai-response-navigation.md): Rule 12, controlled language. Clause 12.1 is the base of guard G2.
276
+ - [documentation-guide](../documentation-guide/SKILL.md): where Mermaid diagrams belong in project docs.
277
+ - [brainstorm-assistant](../brainstorm-assistant/SKILL.md): for the opposite direction, when you have no source yet.
278
+
279
+ ## Version History
280
+
281
+ | Version | Date | Changes |
282
+ |---------|------|---------|
283
+ | 1.0.0 | 2026-10-05 | First release. Three rungs built from one outline. Three Required guards. Evaluation cases. Implements dev-platform XSPEC-450 / DEC-125 D4. |
@@ -0,0 +1,255 @@
1
+ ---
2
+ scope: universal
3
+ description: |
4
+ Evaluation cases and run procedure for the comprehension-ladder skill: 5 source texts with comprehension questions, answer keys and guard-violation checks. Not yet run.
5
+ Use when: you want to measure whether the comprehension-ladder skill helps readers, or to re-check its three guards.
6
+ Keywords: evaluation, eval cases, comprehension questions, answer key, guard violations, DEC-114.
7
+ ---
8
+
9
+ # Comprehension Ladder: Evaluation Cases
10
+
11
+ > **Language**: English | [繁體中文](../../locales/zh-TW/skills/comprehension-ladder/eval-cases.md) | [简体中文](../../locales/zh-CN/skills/comprehension-ladder/eval-cases.md)
12
+
13
+ **Status: not run.** This file holds the cases and the procedure. No model has been called and no reader has answered. Until a run is done, do not say that the skill makes text easier to understand.
14
+
15
+ All five source texts below are written for this evaluation. They describe no real customer, person or system.
16
+
17
+ ## What the run produces
18
+
19
+ A run produces two numbers:
20
+
21
+ 1. **Correct-answer rate, before and after.** The share of questions answered correctly when the reader sees the original text (arm A, "before") and when the reader sees the skill's output (arm B, "after").
22
+ 2. **Guard violations.** The count of times the skill's output breaks guard G1, G2 or G3.
23
+
24
+ A proposed pass line, to be agreed with the owner before the run: arm B is at least 10 percentage points above arm A, and guard violations equal 0. The 10 points are a starting value. They have not been calibrated.
25
+
26
+ ## Procedure
27
+
28
+ ### 1. Render
29
+
30
+ For each case, run the skill on the source text. Ask for rung 1 and rung 2. Save the outline and both rungs. If you also want to test rung 3, ask for it and save the HTML file.
31
+
32
+ Use the same model and the same settings for all five cases. Record the model name.
33
+
34
+ ### 2. Split the readers
35
+
36
+ Use at least 6 readers. Readers can be people or models. People give stronger evidence. Models are a cheaper stand-in.
37
+
38
+ Split the readers into two groups of equal size.
39
+
40
+ | Case | Group 1 reads | Group 2 reads |
41
+ |------|---------------|---------------|
42
+ | 1 | A (original) | B (skill output) |
43
+ | 2 | B | A |
44
+ | 3 | A | B |
45
+ | 4 | B | A |
46
+ | 5 | A | B |
47
+
48
+ Each reader sees each case once. This prevents a reader from learning the answers in one arm and carrying them to the other.
49
+
50
+ A reader in arm B sees only the skill output. They do not see the original text.
51
+
52
+ ### 3. Ask the questions
53
+
54
+ Give each reader the questions for the case. The reader answers from the text they were given. The reader may not use any other source.
55
+
56
+ A reader may answer "the text does not say". That is a correct answer for the questions marked **not stated**.
57
+
58
+ ### 4. Grade the answers
59
+
60
+ Grade each answer against the answer key below. An answer is correct only if it meets the "accept" rule. For questions marked **hedge**, an answer that states the claim as certain is wrong, even if the facts are right.
61
+
62
+ Correct-answer rate = correct answers ÷ all answers, per arm.
63
+
64
+ ### 5. Count guard violations
65
+
66
+ Check each rendered output against the source text. Count each of the following once per item.
67
+
68
+ | Guard | One violation is |
69
+ |-------|------------------|
70
+ | G1 `no-new-facts` | An item or sentence that states something the source does not state. The "traps" list in each case names the most likely ones. |
71
+ | G2 `keep-hedges` | An item whose source claim has a hedge, and whose output has no hedge, or a stronger one. The "hedge inventory" in each case lists the hedges. |
72
+ | G3 `trace-and-gaps` | An item with no Source pointer, a pointer that does not lead to the claimed place, or no Not covered note. Also: the output has no "Left out of this outline" list. |
73
+
74
+ Have a second person count the same outputs, and compare the two counts. If they differ, discuss each difference and record the final count.
75
+
76
+ ### 6. Report
77
+
78
+ Fill in this table. Both numbers must be there.
79
+
80
+ | Case | Arm A correct | Arm B correct | G1 | G2 | G3 |
81
+ |------|---------------|---------------|----|----|----|
82
+ | 1 | / | / | | | |
83
+ | 2 | / | / | | | |
84
+ | 3 | / | / | | | |
85
+ | 4 | / | / | | | |
86
+ | 5 | / | / | | | |
87
+ | **Total** | **rate A** | **rate B** | | | |
88
+
89
+ ### Size of the run
90
+
91
+ The size of the run, so the owner can decide the model and the cost before it starts:
92
+
93
+ - Render step: 5 skill runs, plus 5 guard checks. That is 10 model calls.
94
+ - Reader step, if readers are models: 5 cases × 2 arms × the number of readers per arm.
95
+ - The questions are short. The longest input is one source text or one rendered output.
96
+
97
+ The model choice and the budget are the owner's decision. They are not set here.
98
+
99
+ ---
100
+
101
+ ## Case 1: Stale search results
102
+
103
+ **Type**: incident note with several hedges.
104
+
105
+ ### Source text
106
+
107
+ > After last night's catalog import, the search page showed old product names for about 3 hours. The most likely cause is that the search index was not rebuilt after the import. We think the import job finished before the rebuild step was queued, but we have not checked the job logs yet. Customers could still buy the products. The team plans to add a rebuild step to the import job on Thursday, if the logs confirm the order of events. Nobody has measured how many customers saw the old names.
108
+
109
+ ### Questions and answer key
110
+
111
+ | # | Question | Type | Accept |
112
+ |---|----------|------|--------|
113
+ | 1 | For how long did the search page show old names? | fact | About 3 hours |
114
+ | 2 | What is the most likely cause, and is it confirmed? | hedge | The index was not rebuilt after the import. Not confirmed: "most likely" |
115
+ | 3 | Have the job logs been checked? | fact | No. Not yet |
116
+ | 4 | Could customers still buy the products during the problem? | fact | Yes |
117
+ | 5 | When is the fix planned, and what does it depend on? | fact | Thursday. It depends on the logs confirming the order of events |
118
+ | 6 | How many customers saw the old names? | not stated | The text does not say. Nobody has measured it |
119
+
120
+ ### Hedge inventory
121
+
122
+ "about 3 hours", "most likely", "We think", "have not checked", "if the logs confirm", "Nobody has measured".
123
+
124
+ ### Traps (facts the source does not state)
125
+
126
+ A number of affected customers. A statement that the cause is confirmed. A statement that the logs show the order of events. Any refund, revenue or ticket count.
127
+
128
+ ---
129
+
130
+ ## Case 2: Refund approval flow
131
+
132
+ **Type**: process with a branch (a good fit for rung 2).
133
+
134
+ ### Source text
135
+
136
+ > A customer requests a refund in the app. The system checks the order date. If the order is older than 30 days, the system rejects the request at once and shows the customer a message. If the order is 30 days old or less, the system sends the request to a support agent. The agent approves or rejects it within 2 working days. If the agent approves, the system sends the money back to the original payment method and emails the customer. A refund above NT$5,000 also needs a second approval from a team lead. The spec does not say how long the team lead has to respond.
137
+
138
+ ### Questions and answer key
139
+
140
+ | # | Question | Type | Accept |
141
+ |---|----------|------|--------|
142
+ | 1 | What happens to a request for a 45-day-old order? | fact | Rejected at once. The customer sees a message |
143
+ | 2 | What happens to a request for an order that is exactly 30 days old? | fact | It goes to a support agent ("30 days old or less") |
144
+ | 3 | How long does the agent have to decide? | fact | 2 working days |
145
+ | 4 | Where does the money go after an approval? | fact | The original payment method. The customer also gets an email |
146
+ | 5 | Which refunds need a second approval, and from whom? | fact | Refunds above NT$5,000. From a team lead |
147
+ | 6 | How long does the team lead have to respond? | not stated | The text does not say |
148
+
149
+ ### Hedge inventory
150
+
151
+ None in the claims. The text states one gap: "The spec does not say how long the team lead has to respond." The output must keep that gap.
152
+
153
+ ### Traps
154
+
155
+ A time limit for the team lead. A message text. A rule for refunds of exactly NT$5,000. A step that checks the customer's history.
156
+
157
+ ### Expected size
158
+
159
+ The source holds 7 outline items of kind `mechanism` (request, date check, rejection, routing, agent decision, payment and email, lead approval) and 1 item of kind `uncertainty` (the missing time limit for the team lead). Every rung should show the same 8 items, or list the ones it did not draw.
160
+
161
+ ---
162
+
163
+ ## Case 3: Retry helper
164
+
165
+ **Type**: code walk-through with numbers and two hedged points.
166
+
167
+ ### Source text
168
+
169
+ > The function `fetchWithRetry` calls the payment API up to 4 times. The first call happens at once. After a failed call, it waits before the next one. The wait starts at 200 ms and doubles each time, so the waits are 200 ms, 400 ms and 800 ms. It retries only on network errors and on HTTP status 503. For any other status, such as 400, it stops and returns the error. If all 4 calls fail, it throws the last error. The code adds no random jitter, so many clients that fail together may retry together. We have not tested what happens when the API returns status 429.
170
+
171
+ ### Questions and answer key
172
+
173
+ | # | Question | Type | Accept |
174
+ |---|----------|------|--------|
175
+ | 1 | What is the largest number of calls the function makes? | fact | 4 |
176
+ | 2 | What are the waits between calls? | fact | 200 ms, 400 ms, 800 ms |
177
+ | 3 | Which failures are retried? | fact | Network errors and HTTP status 503 |
178
+ | 4 | What happens on status 400? | fact | It stops and returns the error |
179
+ | 5 | The code adds no jitter. What could follow? | hedge | Many clients that fail together may retry together. It is a possibility, not a certainty |
180
+ | 6 | What happens on status 429? | not stated | Not known. It has not been tested |
181
+
182
+ ### Hedge inventory
183
+
184
+ "may retry together", "We have not tested".
185
+
186
+ ### Traps
187
+
188
+ A behavior for status 429 (retry or no retry). A statement that clients do retry together. A maximum total wait time that the source does not give. A name for the API.
189
+
190
+ ---
191
+
192
+ ## Case 4: Where to store uploaded files
193
+
194
+ **Type**: three options with trade-offs (a good fit for rung 2).
195
+
196
+ ### Source text
197
+
198
+ > We compared three ways to store user uploads. Option A: keep the files on the app server's disk. It is the cheapest and needs no new tools. But the files are lost if the server is replaced, and two servers cannot share them. Option B: use object storage from a cloud provider. It costs about NT$600 per month for the current volume. The files survive a server change, and any server can read them. It needs a one-time access key setup. Option C: use a network file share. Servers can share the files, and no code change is needed. But it adds one more machine to maintain, and we think it will be slower under heavy load. We recommend Option B. We have not tested the speed of Option C.
199
+
200
+ ### Questions and answer key
201
+
202
+ | # | Question | Type | Accept |
203
+ |---|----------|------|--------|
204
+ | 1 | Which option does the text say survives a server replacement? | fact | Option B. (The text says Option A does not. It does not say for Option C.) |
205
+ | 2 | What does Option B cost? | fact | About NT$600 per month for the current volume |
206
+ | 3 | Which option needs no code change? | fact | Option C |
207
+ | 4 | Which option does the team recommend? | fact | Option B |
208
+ | 5 | Is Option C slower under heavy load? | hedge | The team thinks so, but has not tested it |
209
+ | 6 | What does Option C cost? | not stated | The text does not say |
210
+
211
+ ### Hedge inventory
212
+
213
+ "about NT$600", "we think it will be slower", "We have not tested".
214
+
215
+ ### Traps
216
+
217
+ A cost for Option A or Option C. A statement that Option C survives a server replacement. A statement that Option C is slower, without the hedge. A reason for the recommendation that the source does not give.
218
+
219
+ ---
220
+
221
+ ## Case 5: Session tokens in access logs
222
+
223
+ **Type**: security finding with an unknown and a not-yet-rated risk.
224
+
225
+ ### Source text
226
+
227
+ > During a review of the API gateway, we found that the access log can contain session tokens. A token appears in the log when a client sends it in the URL query string instead of the header. The mobile app, version 2.3, does this on the profile screen. Web clients use the header and are not affected. The logs are kept for 90 days, and 12 engineers can read them. We have not found evidence that anyone used a logged token. The risk is probably moderate, but we have not rated it formally. We propose two changes: move the token to the header in the mobile app, and mask query strings in the log. We do not know yet how many users run app version 2.3.
228
+
229
+ ### Questions and answer key
230
+
231
+ | # | Question | Type | Accept |
232
+ |---|----------|------|--------|
233
+ | 1 | When does a token appear in the log? | fact | When a client sends it in the URL query string instead of the header |
234
+ | 2 | Which clients are affected? | fact | The mobile app version 2.3, on the profile screen. Web clients are not affected |
235
+ | 3 | How long are the logs kept, and who can read them? | fact | 90 days. 12 engineers |
236
+ | 4 | Has anyone been shown to have misused a logged token? | hedge | No evidence was found. This is not the same as "nobody did" |
237
+ | 5 | How serious is the risk? | hedge | Probably moderate. Not formally rated |
238
+ | 6 | How many users run app version 2.3? | not stated | Not known yet |
239
+
240
+ ### Hedge inventory
241
+
242
+ "can contain", "We have not found evidence", "probably moderate", "not rated it formally", "We do not know yet".
243
+
244
+ ### Traps
245
+
246
+ A count of affected users. A statement that no token was misused. A formal risk rating (such as "high" or "medium"). A fix date. A statement that web clients are at risk.
247
+
248
+ ---
249
+
250
+ ## After a run
251
+
252
+ - Record the date, the model name, the number of readers and who counted the violations.
253
+ - Put the filled report table beside this file. Do not overwrite the cases.
254
+ - If a guard violation count is above 0, fix the skill before you read anything into the correct-answer rate. A rung that adds a fact or drops a hedge can raise the rate and still mislead the reader.
255
+ - If a source text turns out to be ambiguous, fix the text and the key together, and run that case again.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "universal-dev-standards",
3
- "version": "6.14.0-beta.2",
3
+ "version": "6.14.0-beta.4",
4
4
  "description": "CLI tool for adopting Universal Development Standards",
5
5
  "keywords": [
6
6
  "documentation",
@@ -74,7 +74,7 @@
74
74
  "@eslint/js": "^10.0.1",
75
75
  "@vitest/coverage-v8": "^5.0.0",
76
76
  "eslint": "10.10.0",
77
- "globals": "17.11.0",
77
+ "globals": "17.12.0",
78
78
  "husky": "^9.1.7",
79
79
  "lint-staged": "^17.0.3",
80
80
  "vite": "^8.3.0",
@@ -1281,6 +1281,15 @@ export function checkPreCommitWiring(projectPath, msg) {
1281
1281
  const result = checkPreCommitHookWiring(projectPath);
1282
1282
  if (!result.relevant) return; // 沒有 UDS 管理的 hook
1283
1283
 
1284
+ // 與 wiring 無關的獨立缺陷面:hook 即使已接上,仍可能請 npm 去解析裸名稱 `uds`
1285
+ // ——npm registry 上那個名稱不是本專案。見 git-hooks.js buildPreCommitBlock。
1286
+ if (result.legacyBareUds) {
1287
+ console.log(chalk.yellow((msg.hookBareUdsTitle || '⚠ [pre-commit] {file} asks npm to run the bare name "uds", which on the npm registry is an unrelated package.')
1288
+ .replace('{file}', result.hookFile)));
1289
+ console.log(chalk.gray(msg.hookBareUdsFix || ' Fix: run `uds update`.'));
1290
+ console.log();
1291
+ }
1292
+
1284
1293
  if (result.wired) {
1285
1294
  // 🔴 「已確認會執行」在 POSIX 上為真,在 Windows 上不一定——git for
1286
1295
  // Windows 沒有 POSIX 的 ENOEXEC → /bin/sh 後備機制,缺 shebang 的 hook